July 28, 2026 • 43 mins
As AI adoption accelerates and global regulations evolve, digital sovereignty has shifted from policy concept to board-level priority. In this episode of Smart Talks with IBM, Malcolm Gladwell sits down live at VivaTech with IBM’s Ana Paula Assis and AXA CIO Giovanni D’Aniello to explore how organizations can balance innovation, control, trust, and resilience in the age of AI.
This is a paid advertisement from IBM. The conversations on this podcast don't necessarily represent IBM's positions, strategies or opinions.
Visit us at https://www.ibm.com/think/podcasts/smart-talks
See omnystudio.com/listener for privacy information.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:01):
I'm Malcolm gla Well and you're listening to smart Talks
with IBM. Imagine your business depends on a system you
didn't build and don't fully control. For years, it works perfectly.
It's fast, reliable, affordable, so over time, more and more
of your operations rely on it. Then one day the
terms change. What once felt flexible now feels difficult to leave.
(00:26):
Moving to another provider or bringing those capabilities back under
your own control could take years, cost millions, and disrupt
the business in the process. That's the challenge of digital sovereignty.
Businesses today rely on all sorts of third party systems,
cloud platforms, data pipelines, AI models, software tools. Most days,
(00:50):
these systems operate quietly in the background, but when something changes,
like costs go up or rules shift, organizations are forced
to confront how much control and flexibility.
Speaker 2 (01:03):
They actually have.
Speaker 1 (01:05):
This is why digital sovereignty has shifted from policy concept
to board level priority. So to understand the challenge up close,
I traveled to Paris to attend Vivtec, Europe's largest technology conference,
to speak with two people who think about these questions
every day. On Apaula A Cis IBM's senior vice president
(01:26):
and chair for IBM, EMEA and APAC and Giovanni Daniello,
Group Chief Information Officer at AKSA.
Speaker 2 (01:37):
Hello everyone, Welcome.
Speaker 1 (01:39):
To a live taping of the podcast Smart Talks with IBM.
I was downstairs in the IBM booths chatting with the
people who were doing the data sovereignty presentation, and they
were discussing the thing and I said, oh, it sounds
like you're solving a headache.
Speaker 2 (01:57):
And the guy I was trying to said.
Speaker 1 (02:00):
We do it, IBM. We saw headaches and cure headaches,
and I want to start out with the two of you,
what is the headache in this instance.
Speaker 3 (02:09):
So the topic of sovereignty gained a lot of traction
over the past few years, and even though I would
say it really became a buzzword this year, I think
that this actually started doing COVID when all the supply
chains became extremely stressed and companies and governments started to
(02:31):
understand that there were.
Speaker 4 (02:32):
A lot of choke points in the world.
Speaker 3 (02:34):
Right, so, how can I do more on ear shore
in how can I guarantee that I have autonomy of
key elements of my supply chain? I think was really
the wake up call, and then we entered in a
period of unfortunately many wars happening, constraining for example, energy security.
So all these disruptions in the world led companies and
(02:56):
governments to think, what is really that I need to
consider critical for me, and how do I have better
control of those capabilities? And now technology being at the
core of the operations, I think that actually increased the need.
Speaker 4 (03:10):
For companies to focus on sovereignty. So that is the headache.
Speaker 3 (03:14):
Given that there are so many dependencies, given that we're
living in a world that is so interconnected, how do
you get autonomy, how do you get back control making
sure that you continue to operate in a collaborative ecosystem.
Speaker 5 (03:30):
It's a difficult equilibrium in reality, because we have to
take all those dimensions into consideration, making sure that at
the same time we can continue to access innovation. And
that's where the paradigm is really very, very complicated to solve.
So the headache we have in Exa and then probably
(03:50):
many large organizations in the world is exactly the topic
in Europe at least, It's about sovereignty exactly in the
terms you are talking about, and that's becoming a topic
that is very that is there's a lot of visibility
the agenda at very top executive level since probably it
(04:11):
started with coviy, they agree, but the last two years
there's been an acceleration clearly.
Speaker 3 (04:15):
Yeah, and I really have a few data points. Today
we announced a study through our IBM Institute of Business
Value where basically we asked companies around the world, so,
do you have visibility of your dependencies?
Speaker 6 (04:33):
Right?
Speaker 3 (04:33):
Do you know exactly where are your exposures? And only
nine percent of the companies said that they have that
level of visibility, and seventy one percent of the company
said that if they needed to switch a provider today,
it would be.
Speaker 4 (04:50):
Very difficult to do so.
Speaker 3 (04:51):
So I think the headache this actually shows in numbers
the size of the headache.
Speaker 1 (04:57):
Ye give a year and the insurance business speak to
the specifics of your own business. Why would this be
an issue that Am I right in thinking that this
is an issue that is a specific and special concern
to an insurance No.
Speaker 6 (05:16):
I don't think so.
Speaker 5 (05:17):
No, you know, no, I don't think so, because in reality,
it's an issue for organizations using technology, data and AI
as an important driver within the activities they manage insurance.
Of course, insurance is about data, it's about people, it's
about technology, of course, so it's very very central, but
it's absolutely not limited to insurance because at the end,
(05:41):
if we want to talk a little bit more into details,
what is sovereignty Because everybody talks about sovereignty.
Speaker 6 (05:46):
But what is it about?
Speaker 5 (05:48):
And very often people believe that once you know where
your data are located, and if you are your open company,
if you have the certainty that data are located in Europe,
many people believe I may say I'm sober incompatible, but
it's absolutely not enough. So there are models that not
only we are using an accept that are also very
(06:10):
very public on the market. Very often will refer to
four dimensions. Of course, data location is number one. If
you don't know where your data are, I mean you
don't know anything. But it's not only that, I mean
how do you operate? Who is operating the system, who
is patching, who is creating new versions of whatever the
(06:31):
feature that becomes available.
Speaker 6 (06:33):
That's the second one.
Speaker 5 (06:35):
The third one is contracts, legal terms, who is in
charge legally speaking of the activities we talk about, And
the last one is the technicality itself. Who is really
mastering the technical details, the underlying stack. Is it something
that is European, US, China, you know, and I mean
(06:59):
it's it's known by everybody. Most of the large European
companies and US companies are using US technologies. So the
difficulty in sovereignties to scan on a permanent basinis the
four dimensions, making sure that because you were saying Anna,
that you know exactly what is exactly the situation on
(07:19):
your business on those four dimensions.
Speaker 1 (07:22):
Give me an example of how a specific example of
what difference it would make where your data was being held.
In otherwords, in what sense our regulatory requirements for example,
different from one country to another, or from the EU
to North America, or is there a practical way to
kind of express those differences.
Speaker 3 (07:43):
Yeah, there are very clear regulations in many of the
countries regarding what type of data needs to reside inside
the country, right, so particularly financial data, health data, those
are really really controlled and they have to follow those
regulatory requirements. So the way that we approach that in
(08:07):
our architecture in our platform is to enforce those regulatory
requirements within the platform so that this is not just
relied from a contractual standpoint, but that you ensure with
governance tools and with capabilities that the platform is securing
that data in compliance with those regulatory aspects. And when
(08:30):
you think about sovereignty, it has to go beyond just
the regulatory and compliance requirements. It's really understanding your business requirements.
What are the applications that are truly mission critical and
that you need to ensure that have that level of
control because also controlling everything is not necessarily viable, not
(08:51):
from a technical standpoint and not from a business case standpoint. Right,
So that is the I think that is the challenge
that many companies are going right now, is to have
the visibility of their application mistake, how that matches the
business strategy, and then making the decisions on what is
the level of sovereignty that I need to apply.
Speaker 2 (09:13):
Let's say I'm a naive company.
Speaker 1 (09:15):
I don't pay any attention to this, I have operations
in any different countries. What's the worst case scenario? What's
the down what happens if you don't act kind of
prudently around data sovereignty?
Speaker 3 (09:29):
So I think the first aspect is if something happens
to your infrastructure that is sitting somewhere that you don't
have visibility, goes out for some reason a war and
energy blackout, any other cyber attack in your environment. If
you don't have a fallback plan, if you don't have
(09:50):
a way to move that application to operate from another
place that has the backups the real time data that
you are accessing to, you pretty much go out of
out of operations, right. So it's a that's a very
important question because I think it brings the sovereignty aspect
to what I believe is the strategic role that it plays.
(10:11):
It's about resiliency. It's not about necessarily just meeting regulatory requirements.
And I think you need to do that from a
risk management standpoint, and I think an insurance company is
the best position to do that.
Speaker 4 (10:26):
But it's not just regulations.
Speaker 3 (10:29):
It's really making sure that you have continuous operation twenty
four by seven, which is pretty much what businesses need
to to achieve currectly.
Speaker 5 (10:40):
In some countries for insurance, for example, but not only
for insurance. In some countries there are obligations locally, for example,
to store data in the country. So back to your question,
there's a limit to how naif you can be if
you want to develop a business, because that's at the
(11:01):
heart of getting the authorization to operate and to run
your business in the countries where you would like to.
But then once you are over this kind of m
VP of requirements that are mandatory for you to open
and operate, then of course, I mean that's a good thing.
Speaker 6 (11:17):
That and what you said is completely completely relevant.
Speaker 1 (11:21):
How does how does one anticipate these issues changing over time?
In other words, you said that people are going to
wake up to the importance of data sovereignty during COVID.
I'm just curious if we fast forward five years, do
we imagine that the kind of landscape in which companies
like us, you and I are operating is going to
(11:41):
get more complex or less complex? What's the what's the
movement in this?
Speaker 3 (11:47):
I think it's going to become more complex because AI
is really accelerating all the trends.
Speaker 2 (11:54):
Why I want you to tell can you explain?
Speaker 1 (11:57):
I want you to kind of do a little deep
dive on Y specifically. Is it about AI that's complicating this?
Speaker 4 (12:04):
That's a very good question.
Speaker 3 (12:06):
AI now moves from you know, actions just being taken
from you know, somebody operating a system to the technology
actually making decisions. Right, So you have to have a
much better visibility of what systems AI is touching, what
data it is accessing, and where right, So you have
(12:29):
to have that mapping much more clear because the stakes
are higher now on how technology is actually operating your business.
Speaker 4 (12:37):
Right.
Speaker 3 (12:37):
So I do think that there is an acceleration because
of that. The second element AI is going to increase
the amount of vulnerabilities that are going to be either
identified or created. So you have to have an ability
to continuously monitor, monitor, and scan what is happening in
(12:57):
the cybersecurity landscape so that you can prevent and react
in a much faster way. So there are more elements
of disruption that are coming up as a result of
the acceleration of technology.
Speaker 6 (13:11):
I can give you a concrete example.
Speaker 5 (13:14):
So the way applications work today is pretty much deterministic.
Speaker 6 (13:21):
You have rules, you have data, you have processes.
Speaker 5 (13:23):
Very often embed it into the code, into the business
logic so that are executed and very often if you
have the same inputs, you have the same output. And
so you have I mean application with modules, you have APIs,
you have data, you have you know beautiful.
Speaker 6 (13:40):
Mobile first front ends. You know all these fancy things
that we run on the cloud or on PREMIU in whatever.
Speaker 5 (13:46):
So let's project yourself into a couple of years from
now where the architecture is going to be agentic native
with concepts such as head less applications. So you will
interact with kind of prompt inter phase and you will
start asking as a customer or as an employee or
as a partner, you will ask, interacting and asking a
(14:08):
certain number of problems to be solved. And this is
going to be given through tokens and all these all
these technologies into an ecosystem of digital agents orchestrated and
orchestrating activities looking at what is in the in the
rug in terms of what is the process telling me
about how do I have to manage that? What kind
(14:30):
of data do I have in my repository? And you
enter into something which is going to become much more probabilistic,
and you have llms there in the meantime in the
middle trying to get answers, smart answers to queries that
will come from specialized digital agents. So has nothing to
do with the way applications run today. And if you
(14:54):
look at the flow of data today that we know,
we know where the data located. That was saying, you know,
a lot of things we know and how the data
is going to flow in all the directions in this
Aargentic native architecture. You understand that, as you said that
this is going to accelerate significantly and the need to
(15:15):
understand the underlying stack and architecture in the sovereign ecosystem
is going to be crucial. You know, data can suddenly
become public public in the way they can be used
to train models, and a little bit of your IP
step by steap going to go into those those models
if they learn. If you are not careful, that's what
(15:36):
it's going to happen. Of course, there are ways to
prevent that, but if you're not careful, you can suddenly
see the world around you becoming more intelligent than you
on your own business.
Speaker 1 (15:47):
It seems like there's a this is a very crude
way of putting it, but there's a race going on
with the technology on running one race and then the
other race. Is our ability to kind of make sense
of it, have visibility and integrate the technology into the
way we do our who's winning that race right now?
Speaker 2 (16:05):
Is it? Is it hard to keep up with the technology.
Speaker 3 (16:08):
That's why I think you need the technology to govern
the technology right and and to me, that is what
our proposition with this platform that we launched a few
weeks ago called Sovereign Core, is to provide that that
those that tool in and those capabilities to help organizations
create those capabilities. Because what we learned already is that
(16:31):
as you have money explained very well, the technology is
going to accelerate exponentially. How do you map that with
that same level of speed? Only another technology that is
going to you know, operate at the same level of acceleration.
And that is exactly the proposition that we have in
(16:53):
supporting our clients. So that's the headache that you're trying
to solve.
Speaker 1 (16:58):
Do I'm assuming you've been in this field of technology
for how many.
Speaker 6 (17:02):
Years or thirty years?
Speaker 1 (17:06):
Is there any I'm curious to compare the moment we're
into any previous moments. So you've now lived through several
technological upheavals. How does this one compare to the ones
earlier in your career?
Speaker 5 (17:19):
For me, this one is very clearly the one that
has the highest potential and in terms of speed, there's
no precedent. Everything we've done in the past where we've
been trying to modernize. Let's take a complete, complete exam
modernizing business applications. We had this discussion a couple of
(17:41):
months ago. So like all the companies in the world,
we have legacy applications. All all the companies have legacy
applications that have been written, I don't know, thirty fifty
years ago, and the journey to modernize those applications has
been the last let's say, the last fifteen years, something
like very often a five years ticket every time you
(18:03):
want it to work to modernize something, including migration and decommissioning.
And every time we even a year ago, every time
we were thinking about how there's technology out there we
can go much much, much faster, we've always been blocked
and then we always came back to that unit of
(18:23):
performance of the five years.
Speaker 6 (18:26):
And since this.
Speaker 5 (18:27):
Year, things are become potentially feasible because that's the Augentic revolution,
because then you can specialize agents like people in a team,
to split the process into subtask and everybody is going
to be very smart and intelligent in solving a part
of the problem. And then if you are good enough
to orchestrate that towards an outcome, which could be an
(18:50):
application modernization ABC whatsoever. Potentially I'm saying potentially, but this
is now technologically we see that it can work. You
can do that, not any more five years, but maybe
I don't know, a year and a half, two years,
maybe a little bit less, why not, I don't know.
But you see, the difference is simply huge. I've never
seen that before.
Speaker 4 (19:09):
Yeah, yeah, I agree with that.
Speaker 3 (19:11):
I think the compression that you're seeing in project delivery,
in new products that we are releasing, updating versions of products,
it's something that is absolutely unprecedented. Yeah, so the base
of innovation is happening very fast. And if you think
that AI has already created a tremendous impact, let's wait
(19:32):
for quantum, right, which is going to even take this
to another level.
Speaker 6 (19:37):
And the mixed the combination.
Speaker 4 (19:38):
Prombination of both.
Speaker 2 (19:40):
Yes, it's a very.
Speaker 1 (19:41):
Interesting contradiction at the core of all this, which is
that intuitively, we know that innovation thrives on openness into connectedness,
you know, no border or whatever. But so DATUS already
makes us think very specifically and often, I would imagine,
painfully about the reality of orders.
Speaker 2 (20:04):
How do you manage that contradiction?
Speaker 3 (20:08):
I think that is really the challenge that we are
all facing right now, right, I don't think we have
one hundred percent clear answer yet, there are certain elements
of this stack that clearly, I mean, trying to reinvent
is actually going to be a reinvention.
Speaker 4 (20:27):
Of the wheel.
Speaker 3 (20:28):
Like I mean, I'm not going to develop chips from
the scratch from scratch, for example, infrastructure from scratch. But
there are other elements of the stack that I can
get much better control.
Speaker 1 (20:38):
Right.
Speaker 3 (20:39):
So, for example, to the point that you've anni made before,
where my data is sitting, what is the orchestration layer
that I can implement so that I can bring the
right player at the right time. So look at the
stack of technology that you are implementing and see what
are the elements where number one, it's feasible to achieve
(20:59):
control and number two, I know that it's it's something
that I actually have to do to make my business resilient.
Speaker 4 (21:07):
And focus on those.
Speaker 3 (21:08):
Right, because if you try to address the entire stech,
or if you try to create a model that you
basically build a fortress, that's not going to be even
feasible for you to achieve. Right, I normally say that
sovereignty is not about building walls it's about building bridges, right,
It's how you really created those connections.
Speaker 6 (21:30):
I like, I like the way you phrase it. That's
exactly that.
Speaker 5 (21:34):
Because at the end, if you put sovereignty as an
architecture requirement when you do design, I don't say it's
the it's it's it's the key to this very difficult
you know, paradying, but at least it's making choices easier. So,
(21:55):
for example, if you if you don't put sovereignty as
a business requirements and you want to develop your business
in the cloud, what you are going to do is
probably look at the available features that features from the
cloud provider. You're going to use those features full speed
to go as fast as possible, as efficient as possible,
(22:15):
and get access to all the stack.
Speaker 6 (22:16):
Innovation and everything else. And the day you have a.
Speaker 5 (22:19):
Problem, you cannot switch, or it will take you five
years and five hundred million to switch. If you take
the sovereignty as a requirement by design. When you want
to start the configuration of your stack, you ask yourself,
(22:40):
what do I have to concretely put here as a
configuration item? If I want to be, for example, multi
cloud compatible or multi cloud and on prem compatible, what
kind of additional technologies maybe I have to use in
order to be able to I mean, do some portability
of some workload from one platform to another.
Speaker 6 (23:01):
Not because I want to do that every day, because
it makes no sense.
Speaker 5 (23:04):
But if if tomorrow I have a problem, I want
to be sure that by design I can I know what.
Speaker 6 (23:09):
The process I'm going to use, what's the process is
going to use to do that portability. So these are
elements that Again, if you don't design your architecture using
those those elements, you wake up in the morning you
have a problem and you have no solution except spending
alpha billion euro.
Speaker 5 (23:27):
So that's that's that's the first point I wanted to make.
Now the second point is if you want to turn
technology into a business outcome, at the end, you need
to be very precisely activating a technology you know. So
at the end you have to make a choice, yes
(23:48):
I activate this feature you know, and yes I use
this tech provider this solution.
Speaker 6 (23:54):
At the end, you don't escape.
Speaker 5 (23:57):
And what it also allows to do is make making
sure that in this architecture based design you also make
explicit what you buy.
Speaker 6 (24:08):
From a tech provider and what you do yourself.
Speaker 5 (24:13):
And also what you do yourself for how long because
you can try a certain number of things because you're
not convinced that a certain number of technology providers out
there are sufficiently cross you know, cross cloud platforms, and
and you don't want to end up into a looking situation.
So you can say, I don't feel that it's mature enough,
(24:36):
so I start doing it. But it's not because you
start doing it yourself that you have to be stuck
in that strategy of doing it yourself for fifteen years. Again,
even if you start doing it yourself, in the design
of the way you do it yourself, you plan an
exit door to be able to move into a solution
from a tech provider when the strategy is mature enough.
(24:59):
So that's the difficult guilty and that this is every
day discussions with discipline. What I always recommend the teams
is make the things explicit. There's no right or wrong
answer in a limited timeframe. There is something that is
best today for the company and may not be the
case tomorrow.
Speaker 6 (25:19):
So let's make it explicit.
Speaker 5 (25:21):
And don't miss that that that I mean that extra work,
because it's extra work. This is not something that is
coming really not falling from the sky. This is extra work,
but it's worse doing this this job to be sure
that at least we are always in this equilib difficult
equilibrium between accessing technologies and being sovereign compatible by design, just.
Speaker 3 (25:44):
To stress you saw that Jovan use the word by
design all the time, right, because I think that intentionality
is probably what's different from what we saw in the
past on how companies were adopting innovation. It was very
much driven by convenience and speed, and now you have
to have convenience, speed and intentionality and understand that you know,
(26:08):
you have to have visibility on the decisions you're making,
and you have to keep your choices more open.
Speaker 1 (26:14):
It was curious when you describe the kind of challenges
that come along with data sovereignty. This is also the
way that two of you work together. So I can
image companies Insurance have been working with IBM. I imagine
for as long as they have been insurance and as
long as they've been IBM. But I mean, in this
(26:35):
particular iteration, are we altering the nature the relationship.
Speaker 3 (26:39):
Before I go specifically to the partnership with as, I'm
going to give an example of what you're doing with
another company which I think illustrates very well the intention,
the objective, and the challenge.
Speaker 6 (26:54):
Right.
Speaker 3 (26:54):
So we have a partnership with Loreale as well, right,
which is the cosmetics company. And they were like, okay,
foundational models, large language models are super powerful, Right, But
I invested one hundred years in my company to build
knowledge about building formula for cosmetics.
Speaker 6 (27:12):
Right.
Speaker 3 (27:13):
I don't want to give that expertise, that knowledge away,
So I want to train my own my own foundational model.
They are not going to do the entire stack of
training by themselves, so they partner with us. We provide research,
We provide tooling that allows them to bring their data
and create their own model based on an open source,
(27:36):
pre trained a model. So these are the types of
you know, challenges that companies are facing. And to my
point prior, what is really critical to the point that
you don't want, you know, a third party to have
visibility or access to And when it comes to the
to the relationship with ACTS and many other of our clients,
(27:59):
I think number one is transparency.
Speaker 4 (28:02):
Right.
Speaker 3 (28:02):
They totally understand how our technology operates. What are the
you know, what are the elements that are part of
our architecture that are going to connect with their systems,
and trust becomes really a fundamental element. Jovanni said, there
are things that I'm going to build, there are things
that I'm going to buy, So who am I going
(28:22):
to buy from? Does this company really understand sovereignty by design?
It's part of the way that the architecture their solutions.
I think those are the elements and I think that's
why this discussion is so important right now because it
also levels the play field for us right we at IBM,
we have always been a company focused on technologies for
(28:44):
the corporate world to really implement mission critical workloads. So
I think now people understand why we approach things the
way we approach and why hybrid cloud, you know, giving
companies the ability to access multiple providers either on prem
or in the public domain. While we have approached our
(29:05):
technologies in that in that characterization is because we are
starting to see the challenges of not having a multi
cloud hybrid cloud strategy can actually apply to your business.
Speaker 4 (29:17):
So I think that this is really what changes for
us now.
Speaker 3 (29:21):
We have we are much more conscious on the risks
and those have to be considered when you are making
technical decisions.
Speaker 6 (29:30):
Yeah, I think in contact. Remre with with what you said.
Speaker 5 (29:33):
That's that's that's at the heart of the relationship between
a company like accesle and and a strategic partner technology partner.
If if that understanding is not there, there is no
way we are going to rely on that strategic partner
to build whatever future strategic orientation.
Speaker 6 (29:56):
And and and it's.
Speaker 5 (29:57):
True that today we have a large variet of technologies
running in production as an insurance company, like banks, we
have mainframes running.
Speaker 6 (30:08):
A lot of a lot of business.
Speaker 5 (30:10):
But at the same time we are full speeding the
AI transformation, we have finished the cloud migration, and being
able to understand the full stuck again, that's what is
absolutely critical.
Speaker 1 (30:24):
I had asked you earlier about was there anything particular
about the insurance business when it came to this question.
I want to come back to that a little bit,
because you know, you've both of you have talked about
trust and transparency. Our trust and transparency pretty core considerations
(30:45):
for ensure, I mean, much more so than someone that's making,
you know, handkerchiefs.
Speaker 2 (30:51):
Talk a little bit about Can you revisit that question?
Speaker 5 (30:55):
Yeah, of course, I think you have a very good point.
If I look at the notion of trust. As you said,
insurance is about trust the noble purpose of an insurance company.
Speaker 6 (31:05):
That's what I repeat every time I have the opportunity.
Speaker 5 (31:07):
You know, I'm so happy every morning when I wake
up because I know what I'm waking up acces is
there to help families, companies, individuals when they face real difficulties.
You know why you wake up every morning. You know
what is why it's difficult. And this implies, as you said,
(31:28):
the notion of trust. So of course for us, what
it means. It means one, we need to make sure
you were talking about data healthcare data and.
Speaker 6 (31:38):
Your initial intervention.
Speaker 5 (31:39):
We need to make sure indeed we know perfectly exactly
where our data are stored and what kind of data
we talk about where is it sensitive data health data,
because we need to overprotect that in order to make
sure that data that we have for our customers are
not going to be made public. You know, that's how
(32:00):
our duty to do that. It's again a notion of trust.
Our customers trust that we do that. Insurance companies are
long term companies, and if you don't have trust anymore,
I mean we're simply out of business.
Speaker 6 (32:12):
So data is an important topic.
Speaker 5 (32:14):
But at the same time we talked about cyber You know,
we have a very very strong cyber team and cyber
security practice that we use both of course to protect
AXA like many organisms. I mean we all do that,
of course, but also to help our customers protect themselves.
(32:38):
And we have also used our skills to develop insurance
products for companies to protect them against cyber risks. So
that's also our duty to say, not only we develop
those skills, but we also give that skill back via
an insurance product to our customers because we.
Speaker 6 (32:56):
Want to help them.
Speaker 5 (32:58):
And then, of course back to the notion of trust itself,
if those elements are there at the end, what we
believe as an insurance company, and I agree with you
this is valid for the insurance sector in general, is
that we we if we continue to demonstrate that we
do that very seriously, our customers continue to have a
(33:22):
lot of trust in us, and probably with the air revolution,
the ones who will be able to.
Speaker 6 (33:28):
Be better, if I can use that word.
Speaker 5 (33:31):
Will be the ones who will be able to continuously
demonstrate that can they always deserve the trust that they
received from from from their customers. So yes, of course
this is specific I mean the specific to the insurance
sector probably thinks also such a you know, pharmaceutical companies,
you know things activities where it's very very sensitive.
Speaker 6 (33:53):
Yeah, that's clear.
Speaker 1 (33:55):
Let me ask a question the other way, and maybe
Honor you can jump in here. These considerations might differ
from industry to industry, but can you what about from
big to small? Are is this a more pressing issue
for a multinational than it is for a startup?
Speaker 3 (34:15):
I think that this is this this applies to all
all the companies, right, especially because they startups from today
are not like the startups from the past. Right, everybody
is scaling so fast, right, You're you're seeing companies going
from zero to billion in like months in the current
in the current world, all these startup startups in general,
they operate in a global in a global footprint. So
(34:40):
if I am a startup going into the let's say
the healthcare, right industry, I'll need to follow the regulations,
even if I'm a very small startup.
Speaker 6 (34:50):
Right.
Speaker 3 (34:50):
So I do think that probably what is happening now
is that this applies to different sizes, different industries, probably
some more regulated than others. And going back to the
point of Giovanni on insurance. I think insurance is probably
the industry where this is much more visible, because insurance
(35:12):
is about pricing risk, right, and how do you price
risk based on knowledge, based on probabilities? And that's all data, right,
So data is their product, I would say. But every
company now will have to be watching those aspects because
at day scale, even if they are small, they'll need
to be meeting those requirements.
Speaker 1 (35:33):
If you were to chat with a founder who is
just starting out, came to you and said, what should
I be doing about data sovereignty, what should I get
right on day one?
Speaker 2 (35:44):
What would your advice be?
Speaker 3 (35:45):
I think now it's much easier because when you're starting
from scratch, you can really design your solutions and your
applications already with all that in your mind. Right, So
all the points that Jovanni made before. By design, this
is how you're going to design up front. Understand what
industry are operating in. Understand what are the implications of
(36:08):
the data that you're manipulating, Map the risk and the
critical mission applications that you're going to develop, make sure
that those are really like sovereign to the core, and
you know, start the execution.
Speaker 5 (36:23):
We have not been talking a lot about that. But
if I look at Europe now, for example, encryption is
very critical when you talk sovereignty. Everything you said is
absolutely correct. But that's an advice I would give is
make sure, for example that the management of the keys
is yours, is yours, you know, and do that from
(36:46):
day one. Don't do that because when you do encryption, yeah,
very often, That's what I was saying earlier. So you
have native services, for example, coming from the cloud providers,
and you can encrypt you using donative services and distore
the keys of course that they've been used to do
this encryption, and it's very comfortable. You can go very
(37:11):
you can be very fast, but you lose control mm hm.
And so that's that's a very simple trick that in
the design very often now comes on a regular business
to pay attention. Of course, you can use the services,
but again storing the keys, the keys are yours, so
then nobody can access your data.
Speaker 1 (37:35):
This is a really interesting theme that I'd love to
sort of end on, which is it seemed like there
was a moment in the evolution of technology where the
trend was in the other direction that I was, you
want to do outsource as much as you could and
just focus on a few things. But now you're talking
about the importance of taking back control.
Speaker 2 (37:54):
Is that? Am I right?
Speaker 1 (37:56):
Is this a shift across a number of different dimensions
when it comes to technology right now?
Speaker 6 (38:01):
Yeah?
Speaker 3 (38:01):
I think technology now is so core to the business,
is so central to the strategy that you really have
to take it like any other major component of your
supply chain. And to me, that's the reason why we
have this wake up moment where people understand that I
(38:22):
need to put much more control, I need to have
much more visibility.
Speaker 6 (38:26):
The regulation itself is also creating, in a way.
Speaker 5 (38:31):
The obligation for us for certain activities to have those activities.
Speaker 6 (38:37):
Back under our control.
Speaker 5 (38:39):
For example, if I look at Dora regulation, what is
DORA regulation telling you? Understand your key business processes, map
those key business processes to your underlying technology.
Speaker 6 (38:52):
Check where you have concentration risks.
Speaker 5 (38:55):
Mapping again, starting from your very critical business processes. And
once you've identified the areas where you have concentration, which
is normal, plan strategies, right strategies, test strategies on reversibility
(39:15):
and and so this is.
Speaker 6 (39:18):
A couple of years ago we were doing that.
Speaker 5 (39:23):
I would say, just when we were feeling that something
in a specific area of the architecture was a little
bit strange. Then we were doing a deep dive and
we were very often arriving at the conclusion that probably
there we need to change something. Let's change the technology,
create more portability and bring the thing under control. But
(39:46):
it was really sporadic, you know, it was not systematic.
With the regulation, now it's mandatory. We are as an
insurance company, we have to demonstrate every year we do
the job. So you see, I think you are totally
right in saying that we need to make sure we
have a certain number of activities back under our control.
(40:08):
But it's it's not only us deciding that. I think
it's also regulations forcing us. And from that perspective at
to say, this was a very good initiative.
Speaker 1 (40:19):
When you started Giovanni and you're in this field, you
were probably either down the hall or on another floor,
and now.
Speaker 2 (40:29):
You have to be directly in the c squite. I mean,
these are it's over.
Speaker 1 (40:34):
The course of your career you've probably gone from being
marginal to being essential, which is very fascinating. I'm wondering
did you did you anticipate that transformation.
Speaker 5 (40:45):
A little bit, yes, because I've always been convinced that
in reality, the more the world was going to modernize
and digitize, the more the technology was going to be inevitable.
But again I was I've not anticipated the speed of
the current description that I've not anticipated, you know. I
(41:07):
was thinking about some of the statements that I was
making five years ago, announcing that a certain number of
elements were going to happen probably five two time years
time frame. In the meantime it's over. We have already
another disruption, you know. And I'm not talking fifty years ago.
(41:27):
I'm just talking five years or ten years ago.
Speaker 6 (41:31):
So yeah, I.
Speaker 5 (41:32):
Always had that feeling that technology was going to be
really critical, but I have to be honest and modest,
not that the level it is today.
Speaker 2 (41:40):
Yeah.
Speaker 1 (41:40):
The irony of this conversation is that I over the
I've been a journalist for several decades, and I realized
a few months ago that my data, in which case
is just interviews, you know, interview tape and transcript we
scattered across a million different places. So I did my
own version of this, and I hired a twenty one
year old to sit at my office and physically go
(42:01):
through all my old archives and do my own version
of Malcolm data sovereignty as going on this summer, a
lot less elaterate.
Speaker 4 (42:08):
Good laud practice, good practice.
Speaker 2 (42:11):
Yeah that's good.
Speaker 1 (42:12):
But thank you very much for joining us on Smart
Talks at IBM, and good luck and thank you all
out there for coming and listening.
Speaker 6 (42:22):
Thank you, thank you.
Speaker 1 (42:27):
Smart Talks with IBM is produced by Matt Ramano, Amy Gains, McQuaid,
Trina Menino, and Jake Harper. Engineering by Nina Bird Lawrence,
Mastering by Sarah Braguera, music by Gramoscope, Strategy by Cassidy Meyer.
Smart Talks with IBM is a production of Pushkin Industries
and Ruby Studio at iHeartMedia. To find more Pushkin podcasts,
(42:50):
listen on the iHeartRadio app, Apple Podcasts, or wherever you
listen to podcasts. I'm Malcolm Gladwell. This is a paid
advertisement for IBA. The conversations on this podcast don't necessarily
represent IBM's positions, strategies or opinions.
I'm Malcolm gla Well and you're listening to smart Talks
with IBM. Imagine your business depends on a system you
didn't build and don't fully control. For years, it works perfectly.
It's fast, reliable, affordable, so over time, more and more
of your operations rely on it. Then one day the
terms change. What once felt flexible now feels difficult to leave.
(00:26):
Moving to another provider or bringing those capabilities back under
your own control could take years, cost millions, and disrupt
the business in the process. That's the challenge of digital sovereignty.
Businesses today rely on all sorts of third party systems,
cloud platforms, data pipelines, AI models, software tools. Most days,
(00:50):
these systems operate quietly in the background, but when something changes,
like costs go up or rules shift, organizations are forced
to confront how much control and flexibility.
Speaker 2 (01:03):
They actually have.
Speaker 1 (01:05):
This is why digital sovereignty has shifted from policy concept
to board level priority. So to understand the challenge up close,
I traveled to Paris to attend Vivtec, Europe's largest technology conference,
to speak with two people who think about these questions
every day. On Apaula A Cis IBM's senior vice president
(01:26):
and chair for IBM, EMEA and APAC and Giovanni Daniello,
Group Chief Information Officer at AKSA.
Speaker 2 (01:37):
Hello everyone, Welcome.
Speaker 1 (01:39):
To a live taping of the podcast Smart Talks with IBM.
I was downstairs in the IBM booths chatting with the
people who were doing the data sovereignty presentation, and they
were discussing the thing and I said, oh, it sounds
like you're solving a headache.
Speaker 2 (01:57):
And the guy I was trying to said.
Speaker 1 (02:00):
We do it, IBM. We saw headaches and cure headaches,
and I want to start out with the two of you,
what is the headache in this instance.
Speaker 3 (02:09):
So the topic of sovereignty gained a lot of traction
over the past few years, and even though I would
say it really became a buzzword this year, I think
that this actually started doing COVID when all the supply
chains became extremely stressed and companies and governments started to
(02:31):
understand that there were.
Speaker 4 (02:32):
A lot of choke points in the world.
Speaker 3 (02:34):
Right, so, how can I do more on ear shore
in how can I guarantee that I have autonomy of
key elements of my supply chain? I think was really
the wake up call, and then we entered in a
period of unfortunately many wars happening, constraining for example, energy security.
So all these disruptions in the world led companies and
(02:56):
governments to think, what is really that I need to
consider critical for me, and how do I have better
control of those capabilities? And now technology being at the
core of the operations, I think that actually increased the need.
Speaker 4 (03:10):
For companies to focus on sovereignty. So that is the headache.
Speaker 3 (03:14):
Given that there are so many dependencies, given that we're
living in a world that is so interconnected, how do
you get autonomy, how do you get back control making
sure that you continue to operate in a collaborative ecosystem.
Speaker 5 (03:30):
It's a difficult equilibrium in reality, because we have to
take all those dimensions into consideration, making sure that at
the same time we can continue to access innovation. And
that's where the paradigm is really very, very complicated to solve.
So the headache we have in Exa and then probably
(03:50):
many large organizations in the world is exactly the topic
in Europe at least, It's about sovereignty exactly in the
terms you are talking about, and that's becoming a topic
that is very that is there's a lot of visibility
the agenda at very top executive level since probably it
(04:11):
started with coviy, they agree, but the last two years
there's been an acceleration clearly.
Speaker 3 (04:15):
Yeah, and I really have a few data points. Today
we announced a study through our IBM Institute of Business
Value where basically we asked companies around the world, so,
do you have visibility of your dependencies?
Speaker 6 (04:33):
Right?
Speaker 3 (04:33):
Do you know exactly where are your exposures? And only
nine percent of the companies said that they have that
level of visibility, and seventy one percent of the company
said that if they needed to switch a provider today,
it would be.
Speaker 4 (04:50):
Very difficult to do so.
Speaker 3 (04:51):
So I think the headache this actually shows in numbers
the size of the headache.
Speaker 1 (04:57):
Ye give a year and the insurance business speak to
the specifics of your own business. Why would this be
an issue that Am I right in thinking that this
is an issue that is a specific and special concern
to an insurance No.
Speaker 6 (05:16):
I don't think so.
Speaker 5 (05:17):
No, you know, no, I don't think so, because in reality,
it's an issue for organizations using technology, data and AI
as an important driver within the activities they manage insurance.
Of course, insurance is about data, it's about people, it's
about technology, of course, so it's very very central, but
it's absolutely not limited to insurance because at the end,
(05:41):
if we want to talk a little bit more into details,
what is sovereignty Because everybody talks about sovereignty.
Speaker 6 (05:46):
But what is it about?
Speaker 5 (05:48):
And very often people believe that once you know where
your data are located, and if you are your open company,
if you have the certainty that data are located in Europe,
many people believe I may say I'm sober incompatible, but
it's absolutely not enough. So there are models that not
only we are using an accept that are also very
(06:10):
very public on the market. Very often will refer to
four dimensions. Of course, data location is number one. If
you don't know where your data are, I mean you
don't know anything. But it's not only that, I mean
how do you operate? Who is operating the system, who
is patching, who is creating new versions of whatever the
(06:31):
feature that becomes available.
Speaker 6 (06:33):
That's the second one.
Speaker 5 (06:35):
The third one is contracts, legal terms, who is in
charge legally speaking of the activities we talk about, And
the last one is the technicality itself. Who is really
mastering the technical details, the underlying stack. Is it something
that is European, US, China, you know, and I mean
(06:59):
it's it's known by everybody. Most of the large European
companies and US companies are using US technologies. So the
difficulty in sovereignties to scan on a permanent basinis the
four dimensions, making sure that because you were saying Anna,
that you know exactly what is exactly the situation on
(07:19):
your business on those four dimensions.
Speaker 1 (07:22):
Give me an example of how a specific example of
what difference it would make where your data was being held.
In otherwords, in what sense our regulatory requirements for example,
different from one country to another, or from the EU
to North America, or is there a practical way to
kind of express those differences.
Speaker 3 (07:43):
Yeah, there are very clear regulations in many of the
countries regarding what type of data needs to reside inside
the country, right, so particularly financial data, health data, those
are really really controlled and they have to follow those
regulatory requirements. So the way that we approach that in
(08:07):
our architecture in our platform is to enforce those regulatory
requirements within the platform so that this is not just
relied from a contractual standpoint, but that you ensure with
governance tools and with capabilities that the platform is securing
that data in compliance with those regulatory aspects. And when
(08:30):
you think about sovereignty, it has to go beyond just
the regulatory and compliance requirements. It's really understanding your business requirements.
What are the applications that are truly mission critical and
that you need to ensure that have that level of
control because also controlling everything is not necessarily viable, not
(08:51):
from a technical standpoint and not from a business case standpoint. Right,
So that is the I think that is the challenge
that many companies are going right now, is to have
the visibility of their application mistake, how that matches the
business strategy, and then making the decisions on what is
the level of sovereignty that I need to apply.
Speaker 2 (09:13):
Let's say I'm a naive company.
Speaker 1 (09:15):
I don't pay any attention to this, I have operations
in any different countries. What's the worst case scenario? What's
the down what happens if you don't act kind of
prudently around data sovereignty?
Speaker 3 (09:29):
So I think the first aspect is if something happens
to your infrastructure that is sitting somewhere that you don't
have visibility, goes out for some reason a war and
energy blackout, any other cyber attack in your environment. If
you don't have a fallback plan, if you don't have
(09:50):
a way to move that application to operate from another
place that has the backups the real time data that
you are accessing to, you pretty much go out of
out of operations, right. So it's a that's a very
important question because I think it brings the sovereignty aspect
to what I believe is the strategic role that it plays.
(10:11):
It's about resiliency. It's not about necessarily just meeting regulatory requirements.
And I think you need to do that from a
risk management standpoint, and I think an insurance company is
the best position to do that.
Speaker 4 (10:26):
But it's not just regulations.
Speaker 3 (10:29):
It's really making sure that you have continuous operation twenty
four by seven, which is pretty much what businesses need
to to achieve currectly.
Speaker 5 (10:40):
In some countries for insurance, for example, but not only
for insurance. In some countries there are obligations locally, for example,
to store data in the country. So back to your question,
there's a limit to how naif you can be if
you want to develop a business, because that's at the
(11:01):
heart of getting the authorization to operate and to run
your business in the countries where you would like to.
But then once you are over this kind of m
VP of requirements that are mandatory for you to open
and operate, then of course, I mean that's a good thing.
Speaker 6 (11:17):
That and what you said is completely completely relevant.
Speaker 1 (11:21):
How does how does one anticipate these issues changing over time?
In other words, you said that people are going to
wake up to the importance of data sovereignty during COVID.
I'm just curious if we fast forward five years, do
we imagine that the kind of landscape in which companies
like us, you and I are operating is going to
(11:41):
get more complex or less complex? What's the what's the
movement in this?
Speaker 3 (11:47):
I think it's going to become more complex because AI
is really accelerating all the trends.
Speaker 2 (11:54):
Why I want you to tell can you explain?
Speaker 1 (11:57):
I want you to kind of do a little deep
dive on Y specifically. Is it about AI that's complicating this?
Speaker 4 (12:04):
That's a very good question.
Speaker 3 (12:06):
AI now moves from you know, actions just being taken
from you know, somebody operating a system to the technology
actually making decisions. Right, So you have to have a
much better visibility of what systems AI is touching, what
data it is accessing, and where right, So you have
(12:29):
to have that mapping much more clear because the stakes
are higher now on how technology is actually operating your business.
Speaker 4 (12:37):
Right.
Speaker 3 (12:37):
So I do think that there is an acceleration because
of that. The second element AI is going to increase
the amount of vulnerabilities that are going to be either
identified or created. So you have to have an ability
to continuously monitor, monitor, and scan what is happening in
(12:57):
the cybersecurity landscape so that you can prevent and react
in a much faster way. So there are more elements
of disruption that are coming up as a result of
the acceleration of technology.
Speaker 6 (13:11):
I can give you a concrete example.
Speaker 5 (13:14):
So the way applications work today is pretty much deterministic.
Speaker 6 (13:21):
You have rules, you have data, you have processes.
Speaker 5 (13:23):
Very often embed it into the code, into the business
logic so that are executed and very often if you
have the same inputs, you have the same output. And
so you have I mean application with modules, you have APIs,
you have data, you have you know beautiful.
Speaker 6 (13:40):
Mobile first front ends. You know all these fancy things
that we run on the cloud or on PREMIU in whatever.
Speaker 5 (13:46):
So let's project yourself into a couple of years from
now where the architecture is going to be agentic native
with concepts such as head less applications. So you will
interact with kind of prompt inter phase and you will
start asking as a customer or as an employee or
as a partner, you will ask, interacting and asking a
(14:08):
certain number of problems to be solved. And this is
going to be given through tokens and all these all
these technologies into an ecosystem of digital agents orchestrated and
orchestrating activities looking at what is in the in the
rug in terms of what is the process telling me
about how do I have to manage that? What kind
(14:30):
of data do I have in my repository? And you
enter into something which is going to become much more probabilistic,
and you have llms there in the meantime in the
middle trying to get answers, smart answers to queries that
will come from specialized digital agents. So has nothing to
do with the way applications run today. And if you
(14:54):
look at the flow of data today that we know,
we know where the data located. That was saying, you know,
a lot of things we know and how the data
is going to flow in all the directions in this
Aargentic native architecture. You understand that, as you said that
this is going to accelerate significantly and the need to
(15:15):
understand the underlying stack and architecture in the sovereign ecosystem
is going to be crucial. You know, data can suddenly
become public public in the way they can be used
to train models, and a little bit of your IP
step by steap going to go into those those models
if they learn. If you are not careful, that's what
(15:36):
it's going to happen. Of course, there are ways to
prevent that, but if you're not careful, you can suddenly
see the world around you becoming more intelligent than you
on your own business.
Speaker 1 (15:47):
It seems like there's a this is a very crude
way of putting it, but there's a race going on
with the technology on running one race and then the
other race. Is our ability to kind of make sense
of it, have visibility and integrate the technology into the
way we do our who's winning that race right now?
Speaker 2 (16:05):
Is it? Is it hard to keep up with the technology.
Speaker 3 (16:08):
That's why I think you need the technology to govern
the technology right and and to me, that is what
our proposition with this platform that we launched a few
weeks ago called Sovereign Core, is to provide that that
those that tool in and those capabilities to help organizations
create those capabilities. Because what we learned already is that
(16:31):
as you have money explained very well, the technology is
going to accelerate exponentially. How do you map that with
that same level of speed? Only another technology that is
going to you know, operate at the same level of acceleration.
And that is exactly the proposition that we have in
(16:53):
supporting our clients. So that's the headache that you're trying
to solve.
Speaker 1 (16:58):
Do I'm assuming you've been in this field of technology
for how many.
Speaker 6 (17:02):
Years or thirty years?
Speaker 1 (17:06):
Is there any I'm curious to compare the moment we're
into any previous moments. So you've now lived through several
technological upheavals. How does this one compare to the ones
earlier in your career?
Speaker 5 (17:19):
For me, this one is very clearly the one that
has the highest potential and in terms of speed, there's
no precedent. Everything we've done in the past where we've
been trying to modernize. Let's take a complete, complete exam
modernizing business applications. We had this discussion a couple of
(17:41):
months ago. So like all the companies in the world,
we have legacy applications. All all the companies have legacy
applications that have been written, I don't know, thirty fifty
years ago, and the journey to modernize those applications has
been the last let's say, the last fifteen years, something
like very often a five years ticket every time you
(18:03):
want it to work to modernize something, including migration and decommissioning.
And every time we even a year ago, every time
we were thinking about how there's technology out there we
can go much much, much faster, we've always been blocked
and then we always came back to that unit of
(18:23):
performance of the five years.
Speaker 6 (18:26):
And since this.
Speaker 5 (18:27):
Year, things are become potentially feasible because that's the Augentic revolution,
because then you can specialize agents like people in a team,
to split the process into subtask and everybody is going
to be very smart and intelligent in solving a part
of the problem. And then if you are good enough
to orchestrate that towards an outcome, which could be an
(18:50):
application modernization ABC whatsoever. Potentially I'm saying potentially, but this
is now technologically we see that it can work. You
can do that, not any more five years, but maybe
I don't know, a year and a half, two years,
maybe a little bit less, why not, I don't know.
But you see, the difference is simply huge. I've never
seen that before.
Speaker 4 (19:09):
Yeah, yeah, I agree with that.
Speaker 3 (19:11):
I think the compression that you're seeing in project delivery,
in new products that we are releasing, updating versions of products,
it's something that is absolutely unprecedented. Yeah, so the base
of innovation is happening very fast. And if you think
that AI has already created a tremendous impact, let's wait
(19:32):
for quantum, right, which is going to even take this
to another level.
Speaker 6 (19:37):
And the mixed the combination.
Speaker 4 (19:38):
Prombination of both.
Speaker 2 (19:40):
Yes, it's a very.
Speaker 1 (19:41):
Interesting contradiction at the core of all this, which is
that intuitively, we know that innovation thrives on openness into connectedness,
you know, no border or whatever. But so DATUS already
makes us think very specifically and often, I would imagine,
painfully about the reality of orders.
Speaker 2 (20:04):
How do you manage that contradiction?
Speaker 3 (20:08):
I think that is really the challenge that we are
all facing right now, right, I don't think we have
one hundred percent clear answer yet, there are certain elements
of this stack that clearly, I mean, trying to reinvent
is actually going to be a reinvention.
Speaker 4 (20:27):
Of the wheel.
Speaker 3 (20:28):
Like I mean, I'm not going to develop chips from
the scratch from scratch, for example, infrastructure from scratch. But
there are other elements of the stack that I can
get much better control.
Speaker 1 (20:38):
Right.
Speaker 3 (20:39):
So, for example, to the point that you've anni made before,
where my data is sitting, what is the orchestration layer
that I can implement so that I can bring the
right player at the right time. So look at the
stack of technology that you are implementing and see what
are the elements where number one, it's feasible to achieve
(20:59):
control and number two, I know that it's it's something
that I actually have to do to make my business resilient.
Speaker 4 (21:07):
And focus on those.
Speaker 3 (21:08):
Right, because if you try to address the entire stech,
or if you try to create a model that you
basically build a fortress, that's not going to be even
feasible for you to achieve. Right, I normally say that
sovereignty is not about building walls it's about building bridges, right,
It's how you really created those connections.
Speaker 6 (21:30):
I like, I like the way you phrase it. That's
exactly that.
Speaker 5 (21:34):
Because at the end, if you put sovereignty as an
architecture requirement when you do design, I don't say it's
the it's it's it's the key to this very difficult
you know, paradying, but at least it's making choices easier. So,
(21:55):
for example, if you if you don't put sovereignty as
a business requirements and you want to develop your business
in the cloud, what you are going to do is
probably look at the available features that features from the
cloud provider. You're going to use those features full speed
to go as fast as possible, as efficient as possible,
(22:15):
and get access to all the stack.
Speaker 6 (22:16):
Innovation and everything else. And the day you have a.
Speaker 5 (22:19):
Problem, you cannot switch, or it will take you five
years and five hundred million to switch. If you take
the sovereignty as a requirement by design. When you want
to start the configuration of your stack, you ask yourself,
(22:40):
what do I have to concretely put here as a
configuration item? If I want to be, for example, multi
cloud compatible or multi cloud and on prem compatible, what
kind of additional technologies maybe I have to use in
order to be able to I mean, do some portability
of some workload from one platform to another.
Speaker 6 (23:01):
Not because I want to do that every day, because
it makes no sense.
Speaker 5 (23:04):
But if if tomorrow I have a problem, I want
to be sure that by design I can I know what.
Speaker 6 (23:09):
The process I'm going to use, what's the process is
going to use to do that portability. So these are
elements that Again, if you don't design your architecture using
those those elements, you wake up in the morning you
have a problem and you have no solution except spending
alpha billion euro.
Speaker 5 (23:27):
So that's that's that's the first point I wanted to make.
Now the second point is if you want to turn
technology into a business outcome, at the end, you need
to be very precisely activating a technology you know. So
at the end you have to make a choice, yes
(23:48):
I activate this feature you know, and yes I use
this tech provider this solution.
Speaker 6 (23:54):
At the end, you don't escape.
Speaker 5 (23:57):
And what it also allows to do is make making
sure that in this architecture based design you also make
explicit what you buy.
Speaker 6 (24:08):
From a tech provider and what you do yourself.
Speaker 5 (24:13):
And also what you do yourself for how long because
you can try a certain number of things because you're
not convinced that a certain number of technology providers out
there are sufficiently cross you know, cross cloud platforms, and
and you don't want to end up into a looking situation.
So you can say, I don't feel that it's mature enough,
(24:36):
so I start doing it. But it's not because you
start doing it yourself that you have to be stuck
in that strategy of doing it yourself for fifteen years. Again,
even if you start doing it yourself, in the design
of the way you do it yourself, you plan an
exit door to be able to move into a solution
from a tech provider when the strategy is mature enough.
(24:59):
So that's the difficult guilty and that this is every
day discussions with discipline. What I always recommend the teams
is make the things explicit. There's no right or wrong
answer in a limited timeframe. There is something that is
best today for the company and may not be the
case tomorrow.
Speaker 6 (25:19):
So let's make it explicit.
Speaker 5 (25:21):
And don't miss that that that I mean that extra work,
because it's extra work. This is not something that is
coming really not falling from the sky. This is extra work,
but it's worse doing this this job to be sure
that at least we are always in this equilib difficult
equilibrium between accessing technologies and being sovereign compatible by design, just.
Speaker 3 (25:44):
To stress you saw that Jovan use the word by
design all the time, right, because I think that intentionality
is probably what's different from what we saw in the
past on how companies were adopting innovation. It was very
much driven by convenience and speed, and now you have
to have convenience, speed and intentionality and understand that you know,
(26:08):
you have to have visibility on the decisions you're making,
and you have to keep your choices more open.
Speaker 1 (26:14):
It was curious when you describe the kind of challenges
that come along with data sovereignty. This is also the
way that two of you work together. So I can
image companies Insurance have been working with IBM. I imagine
for as long as they have been insurance and as
long as they've been IBM. But I mean, in this
(26:35):
particular iteration, are we altering the nature the relationship.
Speaker 3 (26:39):
Before I go specifically to the partnership with as, I'm
going to give an example of what you're doing with
another company which I think illustrates very well the intention,
the objective, and the challenge.
Speaker 6 (26:54):
Right.
Speaker 3 (26:54):
So we have a partnership with Loreale as well, right,
which is the cosmetics company. And they were like, okay,
foundational models, large language models are super powerful, Right, But
I invested one hundred years in my company to build
knowledge about building formula for cosmetics.
Speaker 6 (27:12):
Right.
Speaker 3 (27:13):
I don't want to give that expertise, that knowledge away,
So I want to train my own my own foundational model.
They are not going to do the entire stack of
training by themselves, so they partner with us. We provide research,
We provide tooling that allows them to bring their data
and create their own model based on an open source,
(27:36):
pre trained a model. So these are the types of
you know, challenges that companies are facing. And to my
point prior, what is really critical to the point that
you don't want, you know, a third party to have
visibility or access to And when it comes to the
to the relationship with ACTS and many other of our clients,
(27:59):
I think number one is transparency.
Speaker 4 (28:02):
Right.
Speaker 3 (28:02):
They totally understand how our technology operates. What are the
you know, what are the elements that are part of
our architecture that are going to connect with their systems,
and trust becomes really a fundamental element. Jovanni said, there
are things that I'm going to build, there are things
that I'm going to buy, So who am I going
(28:22):
to buy from? Does this company really understand sovereignty by design?
It's part of the way that the architecture their solutions.
I think those are the elements and I think that's
why this discussion is so important right now because it
also levels the play field for us right we at IBM,
we have always been a company focused on technologies for
(28:44):
the corporate world to really implement mission critical workloads. So
I think now people understand why we approach things the
way we approach and why hybrid cloud, you know, giving
companies the ability to access multiple providers either on prem
or in the public domain. While we have approached our
(29:05):
technologies in that in that characterization is because we are
starting to see the challenges of not having a multi
cloud hybrid cloud strategy can actually apply to your business.
Speaker 4 (29:17):
So I think that this is really what changes for
us now.
Speaker 3 (29:21):
We have we are much more conscious on the risks
and those have to be considered when you are making
technical decisions.
Speaker 6 (29:30):
Yeah, I think in contact. Remre with with what you said.
Speaker 5 (29:33):
That's that's that's at the heart of the relationship between
a company like accesle and and a strategic partner technology partner.
If if that understanding is not there, there is no
way we are going to rely on that strategic partner
to build whatever future strategic orientation.
Speaker 6 (29:56):
And and and it's.
Speaker 5 (29:57):
True that today we have a large variet of technologies
running in production as an insurance company, like banks, we
have mainframes running.
Speaker 6 (30:08):
A lot of a lot of business.
Speaker 5 (30:10):
But at the same time we are full speeding the
AI transformation, we have finished the cloud migration, and being
able to understand the full stuck again, that's what is
absolutely critical.
Speaker 1 (30:24):
I had asked you earlier about was there anything particular
about the insurance business when it came to this question.
I want to come back to that a little bit,
because you know, you've both of you have talked about
trust and transparency. Our trust and transparency pretty core considerations
(30:45):
for ensure, I mean, much more so than someone that's making,
you know, handkerchiefs.
Speaker 2 (30:51):
Talk a little bit about Can you revisit that question?
Speaker 5 (30:55):
Yeah, of course, I think you have a very good point.
If I look at the notion of trust. As you said,
insurance is about trust the noble purpose of an insurance company.
Speaker 6 (31:05):
That's what I repeat every time I have the opportunity.
Speaker 5 (31:07):
You know, I'm so happy every morning when I wake
up because I know what I'm waking up acces is
there to help families, companies, individuals when they face real difficulties.
You know why you wake up every morning. You know
what is why it's difficult. And this implies, as you said,
(31:28):
the notion of trust. So of course for us, what
it means. It means one, we need to make sure
you were talking about data healthcare data and.
Speaker 6 (31:38):
Your initial intervention.
Speaker 5 (31:39):
We need to make sure indeed we know perfectly exactly
where our data are stored and what kind of data
we talk about where is it sensitive data health data,
because we need to overprotect that in order to make
sure that data that we have for our customers are
not going to be made public. You know, that's how
(32:00):
our duty to do that. It's again a notion of trust.
Our customers trust that we do that. Insurance companies are
long term companies, and if you don't have trust anymore,
I mean we're simply out of business.
Speaker 6 (32:12):
So data is an important topic.
Speaker 5 (32:14):
But at the same time we talked about cyber You know,
we have a very very strong cyber team and cyber
security practice that we use both of course to protect
AXA like many organisms. I mean we all do that,
of course, but also to help our customers protect themselves.
(32:38):
And we have also used our skills to develop insurance
products for companies to protect them against cyber risks. So
that's also our duty to say, not only we develop
those skills, but we also give that skill back via
an insurance product to our customers because we.
Speaker 6 (32:56):
Want to help them.
Speaker 5 (32:58):
And then, of course back to the notion of trust itself,
if those elements are there at the end, what we
believe as an insurance company, and I agree with you
this is valid for the insurance sector in general, is
that we we if we continue to demonstrate that we
do that very seriously, our customers continue to have a
(33:22):
lot of trust in us, and probably with the air revolution,
the ones who will be able to.
Speaker 6 (33:28):
Be better, if I can use that word.
Speaker 5 (33:31):
Will be the ones who will be able to continuously
demonstrate that can they always deserve the trust that they
received from from from their customers. So yes, of course
this is specific I mean the specific to the insurance
sector probably thinks also such a you know, pharmaceutical companies,
you know things activities where it's very very sensitive.
Speaker 6 (33:53):
Yeah, that's clear.
Speaker 1 (33:55):
Let me ask a question the other way, and maybe
Honor you can jump in here. These considerations might differ
from industry to industry, but can you what about from
big to small? Are is this a more pressing issue
for a multinational than it is for a startup?
Speaker 3 (34:15):
I think that this is this this applies to all
all the companies, right, especially because they startups from today
are not like the startups from the past. Right, everybody
is scaling so fast, right, You're you're seeing companies going
from zero to billion in like months in the current
in the current world, all these startup startups in general,
they operate in a global in a global footprint. So
(34:40):
if I am a startup going into the let's say
the healthcare, right industry, I'll need to follow the regulations,
even if I'm a very small startup.
Speaker 6 (34:50):
Right.
Speaker 3 (34:50):
So I do think that probably what is happening now
is that this applies to different sizes, different industries, probably
some more regulated than others. And going back to the
point of Giovanni on insurance. I think insurance is probably
the industry where this is much more visible, because insurance
(35:12):
is about pricing risk, right, and how do you price
risk based on knowledge, based on probabilities? And that's all data, right,
So data is their product, I would say. But every
company now will have to be watching those aspects because
at day scale, even if they are small, they'll need
to be meeting those requirements.
Speaker 1 (35:33):
If you were to chat with a founder who is
just starting out, came to you and said, what should
I be doing about data sovereignty, what should I get
right on day one?
Speaker 2 (35:44):
What would your advice be?
Speaker 3 (35:45):
I think now it's much easier because when you're starting
from scratch, you can really design your solutions and your
applications already with all that in your mind. Right, So
all the points that Jovanni made before. By design, this
is how you're going to design up front. Understand what
industry are operating in. Understand what are the implications of
(36:08):
the data that you're manipulating, Map the risk and the
critical mission applications that you're going to develop, make sure
that those are really like sovereign to the core, and
you know, start the execution.
Speaker 5 (36:23):
We have not been talking a lot about that. But
if I look at Europe now, for example, encryption is
very critical when you talk sovereignty. Everything you said is
absolutely correct. But that's an advice I would give is
make sure, for example that the management of the keys
is yours, is yours, you know, and do that from
(36:46):
day one. Don't do that because when you do encryption, yeah,
very often, That's what I was saying earlier. So you
have native services, for example, coming from the cloud providers,
and you can encrypt you using donative services and distore
the keys of course that they've been used to do
this encryption, and it's very comfortable. You can go very
(37:11):
you can be very fast, but you lose control mm hm.
And so that's that's a very simple trick that in
the design very often now comes on a regular business
to pay attention. Of course, you can use the services,
but again storing the keys, the keys are yours, so
then nobody can access your data.
Speaker 1 (37:35):
This is a really interesting theme that I'd love to
sort of end on, which is it seemed like there
was a moment in the evolution of technology where the
trend was in the other direction that I was, you
want to do outsource as much as you could and
just focus on a few things. But now you're talking
about the importance of taking back control.
Speaker 2 (37:54):
Is that? Am I right?
Speaker 1 (37:56):
Is this a shift across a number of different dimensions
when it comes to technology right now?
Speaker 6 (38:01):
Yeah?
Speaker 3 (38:01):
I think technology now is so core to the business,
is so central to the strategy that you really have
to take it like any other major component of your
supply chain. And to me, that's the reason why we
have this wake up moment where people understand that I
(38:22):
need to put much more control, I need to have
much more visibility.
Speaker 6 (38:26):
The regulation itself is also creating, in a way.
Speaker 5 (38:31):
The obligation for us for certain activities to have those activities.
Speaker 6 (38:37):
Back under our control.
Speaker 5 (38:39):
For example, if I look at Dora regulation, what is
DORA regulation telling you? Understand your key business processes, map
those key business processes to your underlying technology.
Speaker 6 (38:52):
Check where you have concentration risks.
Speaker 5 (38:55):
Mapping again, starting from your very critical business processes. And
once you've identified the areas where you have concentration, which
is normal, plan strategies, right strategies, test strategies on reversibility
(39:15):
and and so this is.
Speaker 6 (39:18):
A couple of years ago we were doing that.
Speaker 5 (39:23):
I would say, just when we were feeling that something
in a specific area of the architecture was a little
bit strange. Then we were doing a deep dive and
we were very often arriving at the conclusion that probably
there we need to change something. Let's change the technology,
create more portability and bring the thing under control. But
(39:46):
it was really sporadic, you know, it was not systematic.
With the regulation, now it's mandatory. We are as an
insurance company, we have to demonstrate every year we do
the job. So you see, I think you are totally
right in saying that we need to make sure we
have a certain number of activities back under our control.
(40:08):
But it's it's not only us deciding that. I think
it's also regulations forcing us. And from that perspective at
to say, this was a very good initiative.
Speaker 1 (40:19):
When you started Giovanni and you're in this field, you
were probably either down the hall or on another floor,
and now.
Speaker 2 (40:29):
You have to be directly in the c squite. I mean,
these are it's over.
Speaker 1 (40:34):
The course of your career you've probably gone from being
marginal to being essential, which is very fascinating. I'm wondering
did you did you anticipate that transformation.
Speaker 5 (40:45):
A little bit, yes, because I've always been convinced that
in reality, the more the world was going to modernize
and digitize, the more the technology was going to be inevitable.
But again I was I've not anticipated the speed of
the current description that I've not anticipated, you know. I
(41:07):
was thinking about some of the statements that I was
making five years ago, announcing that a certain number of
elements were going to happen probably five two time years
time frame. In the meantime it's over. We have already
another disruption, you know. And I'm not talking fifty years ago.
(41:27):
I'm just talking five years or ten years ago.
Speaker 6 (41:31):
So yeah, I.
Speaker 5 (41:32):
Always had that feeling that technology was going to be
really critical, but I have to be honest and modest,
not that the level it is today.
Speaker 2 (41:40):
Yeah.
Speaker 1 (41:40):
The irony of this conversation is that I over the
I've been a journalist for several decades, and I realized
a few months ago that my data, in which case
is just interviews, you know, interview tape and transcript we
scattered across a million different places. So I did my
own version of this, and I hired a twenty one
year old to sit at my office and physically go
(42:01):
through all my old archives and do my own version
of Malcolm data sovereignty as going on this summer, a
lot less elaterate.
Speaker 4 (42:08):
Good laud practice, good practice.
Speaker 2 (42:11):
Yeah that's good.
Speaker 1 (42:12):
But thank you very much for joining us on Smart
Talks at IBM, and good luck and thank you all
out there for coming and listening.
Speaker 6 (42:22):
Thank you, thank you.
Speaker 1 (42:27):
Smart Talks with IBM is produced by Matt Ramano, Amy Gains, McQuaid,
Trina Menino, and Jake Harper. Engineering by Nina Bird Lawrence,
Mastering by Sarah Braguera, music by Gramoscope, Strategy by Cassidy Meyer.
Smart Talks with IBM is a production of Pushkin Industries
and Ruby Studio at iHeartMedia. To find more Pushkin podcasts,
(42:50):
listen on the iHeartRadio app, Apple Podcasts, or wherever you
listen to podcasts. I'm Malcolm Gladwell. This is a paid
advertisement for IBA. The conversations on this podcast don't necessarily
represent IBM's positions, strategies or opinions.
Host
Malcolm Gladwell
Popular Podcasts
Betrayal Weekly
Betrayal Weekly is back for a new season. Every Thursday, Betrayal Weekly shares first-hand accounts of broken trust, shocking deceptions, and the trail of destruction they leave behind. Hosted by Andrea Gunning, this weekly ongoing series digs into real-life stories of betrayal and the aftermath. From stories of double lives to dark discoveries, these are cautionary tales and accounts of resilience against all odds. From the producers of the critically acclaimed Betrayal series, Betrayal Weekly drops new episodes every Thursday. If you would like to share your story, you can reach out to the Betrayal Team by emailing them at betrayalpod@gmail.com and follow us on Instagram at @betrayalpod and @glasspodcasts. Please join our Substack for additional exclusive content, curated book recommendations, and community discussions. Sign up FREE by clicking this link Beyond Betrayal Substack. Join our community dedicated to truth, resilience, and healing. Your voice matters! Be a part of our Betrayal journey on Substack.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.