Trust Needs Proof: Who Really Controls Your AI?

0:02Speaker 1:I'm Malcolm gla Well and you're listening to smart Talks with IBM. Imagine your business depends on a system you didn't build and don't fully control. For years, it works perfectly. It's fast, reliable, affordable, so over time, more and more of your operations rely on it. Then one day the terms change. What once felt flexible now feels difficult to leave. Moving to another provider or bringing those capabilities back under your own control could take years, cost millions, and disrupt the business in the process. That's the challenge of digital sovereignty.

0:40Speaker 1:Businesses today rely on all sorts of third party systems, cloud platforms, data pipelines, AI models, software tools. Most days, these systems operate quietly in the background, but when something changes, like costs go up or rules shift, organizations are forced to confront how much control and flexibility.

1:03Speaker 2:They actually have.

1:05Speaker 1:This is why digital sovereignty has shifted from policy concept to board level priority. So to understand the challenge up close, I traveled to Paris to attend Vivtec, Europe's largest technology conference, to speak with two people who think about these questions every day. On Apaula A Cis IBM's senior vice president and chair for IBM, EMEA and APAC and Giovanni Daniello, Group Chief Information Officer at AKSA.

1:37Speaker 2:Hello everyone, Welcome.

1:39Speaker 1:To a live taping of the podcast Smart Talks with IBM. I was downstairs in the IBM booths chatting with the people who were doing the data sovereignty presentation, and they were discussing the thing and I said, oh, it sounds like you're solving a headache.

1:57Speaker 2:And the guy I was trying to said.

2:00Speaker 1:We do it, IBM. We saw headaches and cure headaches, and I want to start out with the two of you, what is the headache in this instance.

2:09Speaker 3:So the topic of sovereignty gained a lot of traction over the past few years, and even though I would say it really became a buzzword this year, I think that this actually started doing COVID when all the supply chains became extremely stressed and companies and governments started to understand that there were.

2:32Speaker 4:A lot of choke points in the world.

2:34Speaker 3:Right, so, how can I do more on ear shore in how can I guarantee that I have autonomy of key elements of my supply chain? I think was really the wake up call, and then we entered in a period of unfortunately many wars happening, constraining for example, energy security. So all these disruptions in the world led companies and governments to think, what is really that I need to consider critical for me, and how do I have better control of those capabilities? And now technology being at the core of the operations, I think that actually increased the need.

3:10Speaker 4:For companies to focus on sovereignty. So that is the headache.

3:14Speaker 3:Given that there are so many dependencies, given that we're living in a world that is so interconnected, how do you get autonomy, how do you get back control making sure that you continue to operate in a collaborative ecosystem.

3:30Speaker 5:It's a difficult equilibrium in reality, because we have to take all those dimensions into consideration, making sure that at the same time we can continue to access innovation. And that's where the paradigm is really very, very complicated to solve. So the headache we have in Exa and then probably many large organizations in the world is exactly the topic in Europe at least, It's about sovereignty exactly in the terms you are talking about, and that's becoming a topic that is very that is there's a lot of visibility the agenda at very top executive level since probably it started with coviy, they agree, but the last two years there's been an acceleration clearly.

4:15Speaker 3:Yeah, and I really have a few data points. Today we announced a study through our IBM Institute of Business Value where basically we asked companies around the world, so, do you have visibility of your dependencies?

4:33Speaker 6:Right?

4:33Speaker 3:Do you know exactly where are your exposures? And only nine percent of the companies said that they have that level of visibility, and seventy one percent of the company said that if they needed to switch a provider today, it would be.

4:50Speaker 4:Very difficult to do so.

4:51Speaker 3:So I think the headache this actually shows in numbers the size of the headache.

4:57Speaker 1:Ye give a year and the insurance business speak to the specifics of your own business. Why would this be an issue that Am I right in thinking that this is an issue that is a specific and special concern to an insurance No.

5:16Speaker 6:I don't think so.

5:17Speaker 5:No, you know, no, I don't think so, because in reality, it's an issue for organizations using technology, data and AI as an important driver within the activities they manage insurance. Of course, insurance is about data, it's about people, it's about technology, of course, so it's very very central, but it's absolutely not limited to insurance because at the end, if we want to talk a little bit more into details, what is sovereignty Because everybody talks about sovereignty.

5:46Speaker 6:But what is it about?

5:48Speaker 5:And very often people believe that once you know where your data are located, and if you are your open company, if you have the certainty that data are located in Europe, many people believe I may say I'm sober incompatible, but it's absolutely not enough. So there are models that not only we are using an accept that are also very very public on the market. Very often will refer to four dimensions. Of course, data location is number one. If you don't know where your data are, I mean you don't know anything. But it's not only that, I mean how do you operate? Who is operating the system, who is patching, who is creating new versions of whatever the feature that becomes available.

6:33Speaker 6:That's the second one.

6:35Speaker 5:The third one is contracts, legal terms, who is in charge legally speaking of the activities we talk about, And the last one is the technicality itself. Who is really mastering the technical details, the underlying stack. Is it something that is European, US, China, you know, and I mean it's it's known by everybody. Most of the large European companies and US companies are using US technologies. So the difficulty in sovereignties to scan on a permanent basinis the four dimensions, making sure that because you were saying Anna, that you know exactly what is exactly the situation on your business on those four dimensions.

7:22Speaker 1:Give me an example of how a specific example of what difference it would make where your data was being held. In otherwords, in what sense our regulatory requirements for example, different from one country to another, or from the EU to North America, or is there a practical way to kind of express those differences.

7:43Speaker 3:Yeah, there are very clear regulations in many of the countries regarding what type of data needs to reside inside the country, right, so particularly financial data, health data, those are really really controlled and they have to follow those regulatory requirements. So the way that we approach that in our architecture in our platform is to enforce those regulatory requirements within the platform so that this is not just relied from a contractual standpoint, but that you ensure with governance tools and with capabilities that the platform is securing that data in compliance with those regulatory aspects. And when you think about sovereignty, it has to go beyond just the regulatory and compliance requirements. It's really understanding your business requirements.

8:39Speaker 3:What are the applications that are truly mission critical and that you need to ensure that have that level of control because also controlling everything is not necessarily viable, not from a technical standpoint and not from a business case standpoint. Right, So that is the I think that is the challenge that many companies are going right now, is to have the visibility of their application mistake, how that matches the business strategy, and then making the decisions on what is the level of sovereignty that I need to apply.

9:13Speaker 2:Let's say I'm a naive company.

9:15Speaker 1:I don't pay any attention to this, I have operations in any different countries. What's the worst case scenario? What's the down what happens if you don't act kind of prudently around data sovereignty?

9:29Speaker 3:So I think the first aspect is if something happens to your infrastructure that is sitting somewhere that you don't have visibility, goes out for some reason a war and energy blackout, any other cyber attack in your environment. If you don't have a fallback plan, if you don't have a way to move that application to operate from another place that has the backups the real time data that you are accessing to, you pretty much go out of out of operations, right. So it's a that's a very important question because I think it brings the sovereignty aspect to what I believe is the strategic role that it plays.

10:12Speaker 3:It's about resiliency. It's not about necessarily just meeting regulatory requirements. And I think you need to do that from a risk management standpoint, and I think an insurance company is the best position to do that.

10:26Speaker 4:But it's not just regulations.

10:29Speaker 3:It's really making sure that you have continuous operation twenty four by seven, which is pretty much what businesses need to to achieve currectly.

10:40Speaker 5:In some countries for insurance, for example, but not only for insurance. In some countries there are obligations locally, for example, to store data in the country. So back to your question, there's a limit to how naif you can be if you want to develop a business, because that's at the heart of getting the authorization to operate and to run your business in the countries where you would like to. But then once you are over this kind of m VP of requirements that are mandatory for you to open and operate, then of course, I mean that's a good thing.

11:17Speaker 6:That and what you said is completely completely relevant.

11:21Speaker 1:How does how does one anticipate these issues changing over time? In other words, you said that people are going to wake up to the importance of data sovereignty during COVID. I'm just curious if we fast forward five years, do we imagine that the kind of landscape in which companies like us, you and I are operating is going to get more complex or less complex? What's the what's the movement in this?

11:47Speaker 3:I think it's going to become more complex because AI is really accelerating all the trends.

11:54Speaker 2:Why I want you to tell can you explain?

11:57Speaker 1:I want you to kind of do a little deep dive on Y specifically. Is it about AI that's complicating this?

12:04Speaker 4:That's a very good question.

12:06Speaker 3:AI now moves from you know, actions just being taken from you know, somebody operating a system to the technology actually making decisions. Right, So you have to have a much better visibility of what systems AI is touching, what data it is accessing, and where right, So you have to have that mapping much more clear because the stakes are higher now on how technology is actually operating your business.

12:37Speaker 4:Right.

12:37Speaker 3:So I do think that there is an acceleration because of that. The second element AI is going to increase the amount of vulnerabilities that are going to be either identified or created. So you have to have an ability to continuously monitor, monitor, and scan what is happening in the cybersecurity landscape so that you can prevent and react in a much faster way. So there are more elements of disruption that are coming up as a result of the acceleration of technology.

13:11Speaker 6:I can give you a concrete example.

13:14Speaker 5:So the way applications work today is pretty much deterministic.

13:21Speaker 6:You have rules, you have data, you have processes.

13:23Speaker 5:Very often embed it into the code, into the business logic so that are executed and very often if you have the same inputs, you have the same output. And so you have I mean application with modules, you have APIs, you have data, you have you know beautiful.

13:40Speaker 6:Mobile first front ends. You know all these fancy things that we run on the cloud or on PREMIU in whatever.

13:46Speaker 5:So let's project yourself into a couple of years from now where the architecture is going to be agentic native with concepts such as head less applications. So you will interact with kind of prompt inter phase and you will start asking as a customer or as an employee or as a partner, you will ask, interacting and asking a certain number of problems to be solved. And this is going to be given through tokens and all these all these technologies into an ecosystem of digital agents orchestrated and orchestrating activities looking at what is in the in the rug in terms of what is the process telling me about how do I have to manage that? What kind of data do I have in my repository? And you enter into something which is going to become much more probabilistic, and you have llms there in the meantime in the middle trying to get answers, smart answers to queries that will come from specialized digital agents. So has nothing to do with the way applications run today. And if you look at the flow of data today that we know, we know where the data located. That was saying, you know, a lot of things we know and how the data

15:04Speaker 5:is going to flow in all the directions in this Aargentic native architecture. You understand that, as you said that this is going to accelerate significantly and the need to understand the underlying stack and architecture in the sovereign ecosystem is going to be crucial. You know, data can suddenly become public public in the way they can be used to train models, and a little bit of your IP step by steap going to go into those those models if they learn. If you are not careful, that's what it's going to happen. Of course, there are ways to prevent that, but if you're not careful, you can suddenly see the world around you becoming more intelligent than you on your own business.

15:47Speaker 1:It seems like there's a this is a very crude way of putting it, but there's a race going on with the technology on running one race and then the other race. Is our ability to kind of make sense of it, have visibility and integrate the technology into the way we do our who's winning that race right now?

16:05Speaker 2:Is it? Is it hard to keep up with the technology.

16:08Speaker 3:That's why I think you need the technology to govern the technology right and and to me, that is what our proposition with this platform that we launched a few weeks ago called Sovereign Core, is to provide that that those that tool in and those capabilities to help organizations create those capabilities. Because what we learned already is that as you have money explained very well, the technology is going to accelerate exponentially. How do you map that with that same level of speed? Only another technology that is going to you know, operate at the same level of acceleration.

16:50Speaker 3:And that is exactly the proposition that we have in supporting our clients. So that's the headache that you're trying to solve.

16:58Speaker 1:Do I'm assuming you've been in this field of technology for how many.

17:02Speaker 6:Years or thirty years?

17:06Speaker 1:Is there any I'm curious to compare the moment we're into any previous moments. So you've now lived through several technological upheavals. How does this one compare to the ones earlier in your career?

17:19Speaker 5:For me, this one is very clearly the one that has the highest potential and in terms of speed, there's no precedent. Everything we've done in the past where we've been trying to modernize. Let's take a complete, complete exam modernizing business applications. We had this discussion a couple of months ago. So like all the companies in the world, we have legacy applications. All all the companies have legacy applications that have been written, I don't know, thirty fifty years ago, and the journey to modernize those applications has been the last let's say, the last fifteen years, something like very often a five years ticket every time you want it to work to modernize something, including migration and decommissioning.

18:09Speaker 5:And every time we even a year ago, every time we were thinking about how there's technology out there we can go much much, much faster, we've always been blocked and then we always came back to that unit of performance of the five years.

18:26Speaker 6:And since this.

18:27Speaker 5:Year, things are become potentially feasible because that's the Augentic revolution, because then you can specialize agents like people in a team, to split the process into subtask and everybody is going to be very smart and intelligent in solving a part of the problem. And then if you are good enough to orchestrate that towards an outcome, which could be an application modernization ABC whatsoever. Potentially I'm saying potentially, but this is now technologically we see that it can work. You can do that, not any more five years, but maybe I don't know, a year and a half, two years, maybe a little bit less, why not, I don't know.

19:05Speaker 5:But you see, the difference is simply huge. I've never seen that before.

19:09Speaker 4:Yeah, yeah, I agree with that.

19:11Speaker 3:I think the compression that you're seeing in project delivery, in new products that we are releasing, updating versions of products, it's something that is absolutely unprecedented. Yeah, so the base of innovation is happening very fast. And if you think that AI has already created a tremendous impact, let's wait for quantum, right, which is going to even take this to another level.

19:37Speaker 6:And the mixed the combination.

19:38Speaker 4:Prombination of both.

19:40Speaker 2:Yes, it's a very.

19:41Speaker 1:Interesting contradiction at the core of all this, which is that intuitively, we know that innovation thrives on openness into connectedness, you know, no border or whatever. But so DATUS already makes us think very specifically and often, I would imagine, painfully about the reality of orders.

20:04Speaker 2:How do you manage that contradiction?

20:08Speaker 3:I think that is really the challenge that we are all facing right now, right, I don't think we have one hundred percent clear answer yet, there are certain elements of this stack that clearly, I mean, trying to reinvent is actually going to be a reinvention.

20:27Speaker 4:Of the wheel.

20:28Speaker 3:Like I mean, I'm not going to develop chips from the scratch from scratch, for example, infrastructure from scratch. But there are other elements of the stack that I can get much better control.

20:38Speaker 1:Right.

20:39Speaker 3:So, for example, to the point that you've anni made before, where my data is sitting, what is the orchestration layer that I can implement so that I can bring the right player at the right time. So look at the stack of technology that you are implementing and see what are the elements where number one, it's feasible to achieve control and number two, I know that it's it's something that I actually have to do to make my business resilient.

21:07Speaker 4:And focus on those.

21:08Speaker 3:Right, because if you try to address the entire stech, or if you try to create a model that you basically build a fortress, that's not going to be even feasible for you to achieve. Right, I normally say that sovereignty is not about building walls it's about building bridges, right, It's how you really created those connections.

21:30Speaker 6:I like, I like the way you phrase it. That's exactly that.

21:34Speaker 5:Because at the end, if you put sovereignty as an architecture requirement when you do design, I don't say it's the it's it's it's the key to this very difficult you know, paradying, but at least it's making choices easier. So, for example, if you if you don't put sovereignty as a business requirements and you want to develop your business in the cloud, what you are going to do is probably look at the available features that features from the cloud provider. You're going to use those features full speed to go as fast as possible, as efficient as possible, and get access to all the stack.

22:16Speaker 6:Innovation and everything else. And the day you have a.

22:19Speaker 5:Problem, you cannot switch, or it will take you five years and five hundred million to switch. If you take the sovereignty as a requirement by design. When you want to start the configuration of your stack, you ask yourself, what do I have to concretely put here as a configuration item? If I want to be, for example, multi cloud compatible or multi cloud and on prem compatible, what kind of additional technologies maybe I have to use in order to be able to I mean, do some portability of some workload from one platform to another.

23:01Speaker 6:Not because I want to do that every day, because it makes no sense.

23:04Speaker 5:But if if tomorrow I have a problem, I want to be sure that by design I can I know what.

23:09Speaker 6:The process I'm going to use, what's the process is going to use to do that portability. So these are elements that Again, if you don't design your architecture using those those elements, you wake up in the morning you have a problem and you have no solution except spending alpha billion euro.

23:27Speaker 5:So that's that's that's the first point I wanted to make. Now the second point is if you want to turn technology into a business outcome, at the end, you need to be very precisely activating a technology you know. So at the end you have to make a choice, yes I activate this feature you know, and yes I use this tech provider this solution.

23:54Speaker 6:At the end, you don't escape.

23:57Speaker 5:And what it also allows to do is make making sure that in this architecture based design you also make explicit what you buy.

24:09Speaker 6:From a tech provider and what you do yourself.

24:13Speaker 5:And also what you do yourself for how long because you can try a certain number of things because you're not convinced that a certain number of technology providers out there are sufficiently cross you know, cross cloud platforms, and and you don't want to end up into a looking situation. So you can say, I don't feel that it's mature enough, so I start doing it. But it's not because you start doing it yourself that you have to be stuck in that strategy of doing it yourself for fifteen years. Again, even if you start doing it yourself, in the design of the way you do it yourself, you plan an exit door to be able to move into a solution from a tech provider when the strategy is mature enough.

24:59Speaker 5:So that's the difficult guilty and that this is every day discussions with discipline. What I always recommend the teams is make the things explicit. There's no right or wrong answer in a limited timeframe. There is something that is best today for the company and may not be the case tomorrow.

25:19Speaker 6:So let's make it explicit.

25:21Speaker 5:And don't miss that that that I mean that extra work, because it's extra work. This is not something that is coming really not falling from the sky. This is extra work, but it's worse doing this this job to be sure that at least we are always in this equilib difficult equilibrium between accessing technologies and being sovereign compatible by design, just.

25:44Speaker 3:To stress you saw that Jovan use the word by design all the time, right, because I think that intentionality is probably what's different from what we saw in the past on how companies were adopting innovation. It was very much driven by convenience and speed, and now you have to have convenience, speed and intentionality and understand that you know, you have to have visibility on the decisions you're making, and you have to keep your choices more open.

26:14Speaker 1:It was curious when you describe the kind of challenges that come along with data sovereignty. This is also the way that two of you work together. So I can image companies Insurance have been working with IBM. I imagine for as long as they have been insurance and as long as they've been IBM. But I mean, in this particular iteration, are we altering the nature the relationship.

26:39Speaker 3:Before I go specifically to the partnership with as, I'm going to give an example of what you're doing with another company which I think illustrates very well the intention, the objective, and the challenge.

26:54Speaker 6:Right.

26:54Speaker 3:So we have a partnership with Loreale as well, right, which is the cosmetics company. And they were like, okay, foundational models, large language models are super powerful, Right, But I invested one hundred years in my company to build knowledge about building formula for cosmetics.

27:12Speaker 6:Right.

27:13Speaker 3:I don't want to give that expertise, that knowledge away, So I want to train my own my own foundational model. They are not going to do the entire stack of training by themselves, so they partner with us. We provide research, We provide tooling that allows them to bring their data and create their own model based on an open source, pre trained a model. So these are the types of you know, challenges that companies are facing. And to my point prior, what is really critical to the point that you don't want, you know, a third party to have visibility or access to And when it comes to the to the relationship with ACTS and many other of our clients, I think number one is transparency.

28:02Speaker 4:Right.

28:02Speaker 3:They totally understand how our technology operates. What are the you know, what are the elements that are part of our architecture that are going to connect with their systems, and trust becomes really a fundamental element. Jovanni said, there are things that I'm going to build, there are things that I'm going to buy, So who am I going to buy from? Does this company really understand sovereignty by design? It's part of the way that the architecture their solutions.

28:31Speaker 3:I think those are the elements and I think that's why this discussion is so important right now because it also levels the play field for us right we at IBM, we have always been a company focused on technologies for the corporate world to really implement mission critical workloads. So I think now people understand why we approach things the way we approach and why hybrid cloud, you know, giving companies the ability to access multiple providers either on prem or in the public domain. While we have approached our technologies in that in that characterization is because we are starting to see the challenges of not having a multi cloud hybrid cloud strategy can actually apply to your business.

29:17Speaker 4:So I think that this is really what changes for us now.

29:21Speaker 3:We have we are much more conscious on the risks and those have to be considered when you are making technical decisions.

29:30Speaker 6:Yeah, I think in contact. Remre with with what you said.

29:33Speaker 5:That's that's that's at the heart of the relationship between a company like accesle and and a strategic partner technology partner. If if that understanding is not there, there is no way we are going to rely on that strategic partner to build whatever future strategic orientation.

29:56Speaker 6:And and and it's.

29:57Speaker 5:True that today we have a large variet of technologies running in production as an insurance company, like banks, we have mainframes running.

30:08Speaker 6:A lot of a lot of business.

30:10Speaker 5:But at the same time we are full speeding the AI transformation, we have finished the cloud migration, and being able to understand the full stuck again, that's what is absolutely critical.

30:24Speaker 1:I had asked you earlier about was there anything particular about the insurance business when it came to this question. I want to come back to that a little bit, because you know, you've both of you have talked about trust and transparency. Our trust and transparency pretty core considerations for ensure, I mean, much more so than someone that's making, you know, handkerchiefs.

30:51Speaker 2:Talk a little bit about Can you revisit that question?

30:55Speaker 5:Yeah, of course, I think you have a very good point. If I look at the notion of trust. As you said, insurance is about trust the noble purpose of an insurance company.

31:05Speaker 6:That's what I repeat every time I have the opportunity.

31:07Speaker 5:You know, I'm so happy every morning when I wake up because I know what I'm waking up acces is there to help families, companies, individuals when they face real difficulties. You know why you wake up every morning. You know what is why it's difficult. And this implies, as you said, the notion of trust. So of course for us, what it means. It means one, we need to make sure you were talking about data healthcare data and.

31:38Speaker 6:Your initial intervention.

31:39Speaker 5:We need to make sure indeed we know perfectly exactly where our data are stored and what kind of data we talk about where is it sensitive data health data, because we need to overprotect that in order to make sure that data that we have for our customers are not going to be made public. You know, that's how our duty to do that. It's again a notion of trust. Our customers trust that we do that. Insurance companies are long term companies, and if you don't have trust anymore, I mean we're simply out of business.

32:12Speaker 6:So data is an important topic.

32:15Speaker 5:But at the same time we talked about cyber You know, we have a very very strong cyber team and cyber security practice that we use both of course to protect AXA like many organisms. I mean we all do that, of course, but also to help our customers protect themselves. And we have also used our skills to develop insurance products for companies to protect them against cyber risks. So that's also our duty to say, not only we develop those skills, but we also give that skill back via an insurance product to our customers because we.

32:56Speaker 6:Want to help them.

32:58Speaker 5:And then, of course back to the notion of trust itself, if those elements are there at the end, what we believe as an insurance company, and I agree with you this is valid for the insurance sector in general, is that we we if we continue to demonstrate that we do that very seriously, our customers continue to have a lot of trust in us, and probably with the air revolution, the ones who will be able to.

33:28Speaker 6:Be better, if I can use that word.

33:31Speaker 5:Will be the ones who will be able to continuously demonstrate that can they always deserve the trust that they received from from from their customers. So yes, of course this is specific I mean the specific to the insurance sector probably thinks also such a you know, pharmaceutical companies, you know things activities where it's very very sensitive.

33:53Speaker 6:Yeah, that's clear.

33:55Speaker 1:Let me ask a question the other way, and maybe Honor you can jump in here. These considerations might differ from industry to industry, but can you what about from big to small? Are is this a more pressing issue for a multinational than it is for a startup?

34:15Speaker 3:I think that this is this this applies to all all the companies, right, especially because they startups from today are not like the startups from the past. Right, everybody is scaling so fast, right, You're you're seeing companies going from zero to billion in like months in the current in the current world, all these startup startups in general, they operate in a global in a global footprint. So if I am a startup going into the let's say the healthcare, right industry, I'll need to follow the regulations, even if I'm a very small startup.

34:50Speaker 6:Right.

34:50Speaker 3:So I do think that probably what is happening now is that this applies to different sizes, different industries, probably some more regulated than others. And going back to the point of Giovanni on insurance. I think insurance is probably the industry where this is much more visible, because insurance is about pricing risk, right, and how do you price risk based on knowledge, based on probabilities? And that's all data, right, So data is their product, I would say. But every company now will have to be watching those aspects because at day scale, even if they are small, they'll need to be meeting those requirements.

35:34Speaker 1:If you were to chat with a founder who is just starting out, came to you and said, what should I be doing about data sovereignty, what should I get right on day one?

35:44Speaker 2:What would your advice be?

35:45Speaker 3:I think now it's much easier because when you're starting from scratch, you can really design your solutions and your applications already with all that in your mind. Right, So all the points that Jovanni made before. By design, this is how you're going to design up front. Understand what industry are operating in. Understand what are the implications of the data that you're manipulating, Map the risk and the critical mission applications that you're going to develop, make sure that those are really like sovereign to the core, and you know, start the execution.

36:23Speaker 5:We have not been talking a lot about that. But if I look at Europe now, for example, encryption is very critical when you talk sovereignty. Everything you said is absolutely correct. But that's an advice I would give is make sure, for example that the management of the keys is yours, is yours, you know, and do that from day one. Don't do that because when you do encryption, yeah, very often, That's what I was saying earlier. So you have native services, for example, coming from the cloud providers, and you can encrypt you using donative services and distore the keys of course that they've been used to do this encryption, and it's very comfortable. You can go very you can be very fast, but you lose control mm hm.

37:16Speaker 5:And so that's that's a very simple trick that in the design very often now comes on a regular business to pay attention. Of course, you can use the services, but again storing the keys, the keys are yours, so then nobody can access your data.

37:35Speaker 1:This is a really interesting theme that I'd love to sort of end on, which is it seemed like there was a moment in the evolution of technology where the trend was in the other direction that I was, you want to do outsource as much as you could and just focus on a few things. But now you're talking about the importance of taking back control.

37:54Speaker 2:Is that? Am I right?

37:56Speaker 1:Is this a shift across a number of different dimensions when it comes to technology right now?

38:01Speaker 6:Yeah?

38:02Speaker 3:I think technology now is so core to the business, is so central to the strategy that you really have to take it like any other major component of your supply chain. And to me, that's the reason why we have this wake up moment where people understand that I need to put much more control, I need to have much more visibility.

38:26Speaker 6:The regulation itself is also creating, in a way.

38:31Speaker 5:The obligation for us for certain activities to have those activities.

38:37Speaker 6:Back under our control.

38:39Speaker 5:For example, if I look at Dora regulation, what is DORA regulation telling you? Understand your key business processes, map those key business processes to your underlying technology.

38:52Speaker 6:Check where you have concentration risks.

38:55Speaker 5:Mapping again, starting from your very critical business processes. And once you've identified the areas where you have concentration, which is normal, plan strategies, right strategies, test strategies on reversibility and and so this is.

39:18Speaker 6:A couple of years ago we were doing that.

39:23Speaker 5:I would say, just when we were feeling that something in a specific area of the architecture was a little bit strange. Then we were doing a deep dive and we were very often arriving at the conclusion that probably there we need to change something. Let's change the technology, create more portability and bring the thing under control. But it was really sporadic, you know, it was not systematic. With the regulation, now it's mandatory. We are as an insurance company, we have to demonstrate every year we do the job. So you see, I think you are totally right in saying that we need to make sure we have a certain number of activities back under our control.

40:09Speaker 5:But it's it's not only us deciding that. I think it's also regulations forcing us. And from that perspective at to say, this was a very good initiative.

40:19Speaker 1:When you started Giovanni and you're in this field, you were probably either down the hall or on another floor, and now.

40:29Speaker 2:You have to be directly in the c squite. I mean, these are it's over.

40:34Speaker 1:The course of your career you've probably gone from being marginal to being essential, which is very fascinating. I'm wondering did you did you anticipate that transformation.

40:45Speaker 5:A little bit, yes, because I've always been convinced that in reality, the more the world was going to modernize and digitize, the more the technology was going to be inevitable. But again I was I've not anticipated the speed of the current description that I've not anticipated, you know. I was thinking about some of the statements that I was making five years ago, announcing that a certain number of elements were going to happen probably five two time years time frame. In the meantime it's over. We have already another disruption, you know. And I'm not talking fifty years ago.

41:28Speaker 5:I'm just talking five years or ten years ago.

41:31Speaker 6:So yeah, I.

41:32Speaker 5:Always had that feeling that technology was going to be really critical, but I have to be honest and modest, not that the level it is today.

41:40Speaker 2:Yeah.

41:40Speaker 1:The irony of this conversation is that I over the I've been a journalist for several decades, and I realized a few months ago that my data, in which case is just interviews, you know, interview tape and transcript we scattered across a million different places. So I did my own version of this, and I hired a twenty one year old to sit at my office and physically go through all my old archives and do my own version of Malcolm data sovereignty as going on this summer, a lot less elaterate.

42:08Speaker 4:Good laud practice, good practice.

42:11Speaker 2:Yeah that's good.

42:12Speaker 1:But thank you very much for joining us on Smart Talks at IBM, and good luck and thank you all out there for coming and listening.

42:22Speaker 6:Thank you, thank you.

42:27Speaker 1:Smart Talks with IBM is produced by Matt Ramano, Amy Gains, McQuaid, Trina Menino, and Jake Harper. Engineering by Nina Bird Lawrence, Mastering by Sarah Braguera, music by Gramoscope, Strategy by Cassidy Meyer. Smart Talks with IBM is a production of Pushkin Industries and Ruby Studio at iHeartMedia. To find more Pushkin podcasts, listen on the iHeartRadio app, Apple Podcasts, or wherever you listen to podcasts. I'm Malcolm Gladwell. This is a paid advertisement for IBA. The conversations on this podcast don't necessarily represent IBM's positions, strategies or opinions.