- 5 months ago
As AI adoption accelerates and regulations tighten across Europe, digital sovereignty has shifted from policy concept to board level priority. In this live episode of Smart Talks with IBM, Malcolm Gladwell joins IBM’s Ana Paula Assis and AXA CIO Giovanni D’Aniello to unpack how organizations can balance innovation with control—building sovereign, secure, and AI-ready digital foundations. Together, they’ll explore how sovereignty is becoming a competitive advantage for enterprises navigating global dependencies, rising compliance demands, and the next era of trusted digital business.
Category
🤖
TechTranscript
00:00Hello, everyone. Welcome to a live taping of the podcast Smart Talks with IBM.
00:09I'm glad you could all join us. I'm with Ana and Giovanni. Thank you for coming.
00:17Ana, you're a Brazilian living in Spain. You've had some very difficult choices to make over the last couple of
00:24weeks.
00:24The last few weeks, yes. Well, let's see where this is going, right?
00:28As I told you, I'm not going to reveal who I'm rooting for.
00:31Yeah, that's right. Although you're in the wonderful position of being able to declare victory in two instances, not just
00:40one.
00:40Absolutely. Let's see. Let's see what they're going to do.
00:44Giovanni, I was reading in the Financial Times an interview with your CEO last weekend, and I learned that you
00:52are an insurer, but you also own some vineyards in France.
00:56Yes.
00:56Which is the most French thing I've ever heard, that an insurance company would have.
01:01So you two know each other. Tell me about how you first met.
01:06Do you want to start or do you want me to start?
01:08I can start if you wish. Yes, we met a few years ago.
01:11I have to say we had a very difficult situation to manage. And we started the collaboration together. And Anna
01:21has been very, very helpful in solving the difficult situation. And since then, we have continued this thing very transparent
01:28and professional relationship.
01:31That's right. So when I took the role for EMEA and I moved to Europe, probably my first assignment was
01:38you have to go to Paris and you have to go meet AXA.
01:41And we needed to restructure the way that our relationship was happening at the time. And I was very fortunate
01:49to have Giovanni on the other side of the table.
01:52Because he was challenging sometimes and tough, but always very constructive, very sensible, always bringing a very rational approach to
02:02the issues that we needed to solve.
02:04So, and after that, I think our relationship really moved to another level and has been evolving since then.
02:11Yeah. So we're going to be talking about data sovereignty. And I was downstairs in the IBM booth chatting with
02:18the people who were doing the data sovereignty presentation and they were discussing the thing.
02:24And I said, oh, it sounds like you're solving a headache. And the guy I was chatting to you said,
02:30that's what we do at IBM. We solve headaches and cure headaches.
02:33And I wanted to start out with the two of you. What is the headache in this instance?
02:40So the topic of sovereignty gained a lot of traction over the past few years. And even though I would
02:47say it really became a buzzword this year, I think that this actually started during COVID.
02:53When all the supply chains became extremely stressed and companies and governments started to understand that there were a lot
03:03of choke points in the world, right?
03:05So how can I do more near-shoring? How can I guarantee that I have autonomy of key elements of
03:12my supply chain?
03:12I think was really the wake-up call. And then we entered in a period of, unfortunately, many wars happening,
03:20constraining, for example, energy security.
03:22So all these different disruptions in the world led companies and governments to think, what is really that I need
03:31to consider as critical for me and how do I have better control of those capabilities?
03:36And now technology being at the core of the operations and with AI really becoming a technology that actually acts,
03:45that actually makes decisions, you cannot leave that in a way that is implemented with that level of risk.
03:54And I think that actually increased the need for companies to focus on sovereignty.
03:58So that is the headache. Given that there are so many dependencies, given that we are living in a world
04:04that is so interconnected, how do you gain autonomy?
04:08How do you get back control, making sure that you continue to operate in a collaborative ecosystem? Make sense?
04:18I think, honestly, what I was going to say is exactly what Anna, you said.
04:21The only thing I can add is it's a difficult equilibrium in reality because we have to take all those
04:27dimensions into consideration, making sure that at the same time we can continue to access innovation.
04:35And that's where the paradigm is really very, very complicated to solve.
04:40So the headache we have in AXA and probably many large organizations in the world is exactly the topic in
04:49Europe, at least.
04:50It's about sovereignty, exactly in the terms you are talking about.
04:54And that's becoming a topic that is very, that is, there's a lot of visibility, very high in the agenda,
05:01at very top executive level since probably, yeah, it started with COVID, I agree.
05:07But the last two years, there has been an acceleration, clearly.
05:09Yeah, and I really have a few data points.
05:12Today, we announced a study through our IBM Institute of Business Value, where basically we asked companies around the world,
05:23so do you have visibility of your dependencies, right?
05:27Do you know exactly where are your exposures?
05:31And only 9% of the companies said that they have that level of visibility.
05:37And 71% of the companies said that if they needed to switch a provider today, it would be very
05:44difficult to do so.
05:45So I think the headache, this actually shows in numbers the size of the headache.
05:51Yeah.
05:52I want to, Giovanni, you're in the insurance business.
05:56Speak to the specifics of your own business.
05:59Why would this be an issue that, am I right in thinking that this is an issue that is a
06:04specific and special concern to an insurer?
06:10No, I don't think so, no.
06:12You don't.
06:12No, I don't think so.
06:13Because in reality, it's an issue for organizations using technology, data, and AI as an important driver within the activities
06:22they manage.
06:24Insurance, of course.
06:25Insurance is about data.
06:27It's about people.
06:28It's about technology, of course.
06:29So it's very, very central.
06:31But it's absolutely not limited to insurance.
06:34Because at the end, if we want to talk a little bit more into details, what is sovereignty?
06:39Because everybody talks about sovereignty.
06:41But what is it about?
06:42And very often, people believe that once you know where your data are located, and if you are a European
06:48company, if you have the certainty that data are located in Europe, many people believe I'm safe.
06:55I'm sovereign compatible.
06:57Well, it's absolutely not enough.
06:59So there are models that not only we are using in AXA, but that are also very, very public on
07:06the market.
07:06Very often, we refer to four dimensions.
07:09Of course, data location is number one.
07:11If you don't know where your data are, I mean, you don't know anything.
07:15But it's not only that.
07:17I mean, how do you operate?
07:19Who is operating the system?
07:21Who is patching?
07:22Who is creating new versions of whatever the feature that becomes available?
07:27That's the second one.
07:28The third one is contracts, legal terms.
07:33Who is in charge, legally speaking, of the activities we talk about?
07:39And the last one is the technicality itself.
07:42Who is really mastering the technical details, the underlying stack?
07:48Is it something that is European, US, China?
07:52I mean, it's known by everybody.
07:55Most of the large European companies and US companies are using US technologies.
08:03So the difficulty in sovereignty is to scan on a permanent basis the four dimensions,
08:09making sure that, as you were saying, Anna, that you know exactly what is exactly the situation on your business
08:14on those four dimensions.
08:16So that's about sovereignty.
08:19And that's why, I mean, if you understand that, you understand that it's not limited to the insurance business.
08:24It's a little bit everywhere.
08:26Yeah.
08:27Give me an example of how, you know, a specific example of what difference it would make where your data
08:37was being held.
08:38In other words, in what sense are regulatory requirements, for example, different from one country to another or from the
08:45EU to North America?
08:47Or is there a practical way to kind of express those differences?
08:51Yeah, there are very clear regulations in many of the countries regarding what type of data needs to reside inside
08:59the country, right?
09:01So particularly financial data, health data, those are really, really controlled.
09:09And they have to follow those regulatory requirements.
09:12So the way that we approach that in our architecture and in our platform is to enforce those regulatory requirements
09:21within the platform.
09:22So that this is not just relied from a contractual standpoint, but that you ensure with governance tools and with
09:29capabilities that the platform is securing that data in compliance with those regulatory aspects.
09:36And when you think about sovereignty, it has to go beyond just the regulatory and compliance requirements.
09:44It's really understanding your business requirements.
09:47What are the applications that are truly mission critical and that you need to ensure that have that level of
09:53control?
09:54Because also, controlling everything is not necessarily viable, not from a technical standpoint and not from a business case standpoint,
10:03right?
10:03So that is the, I think that is the challenge that many companies are going right now is to have
10:09the visibility of their application stake, how that matches the business strategy and then making the decisions on what is
10:17the level of sovereignty that I need to apply.
10:21Give me any absence of, let's say, let's say I'm a naive company.
10:25I don't pay any attention to this.
10:28I have operations in many different countries.
10:31What's the worst case scenario?
10:33What's the doubt?
10:34What happens if you don't act kind of prudently around data sovereignty?
10:39So I think the first aspect is if something happens to your infrastructure that is sitting somewhere that you don't
10:47have visibility goes out for some reason.
10:50A war, an energy blackout, any other cyber attack in your environment, if you don't have a fallback plan, if
11:00you don't have a way to move that application to operate from another place that has the backups, the real
11:06-time data that you are accessing to, you pretty much go out of operations, right?
11:11So that's a very important question because I think it brings the sovereignty aspect to what I believe is the
11:20strategic role that it plays.
11:22It's about resiliency.
11:23It's not about necessarily just meeting regulatory requirements.
11:28And I think you need to do that from a risk management standpoint, and I think an insurance company is
11:34the best position to do that.
11:36But it's not just regulations.
11:39It's really making sure that you have continuous operation, 24 by 7, which is pretty much all what businesses need
11:47to achieve currently.
11:51Maybe if I can add on this one, because in some countries, for insurance, for example, but not only for
11:58insurance, in some countries, there are obligations locally, for example, to store data in the country.
12:07So it's Turkey, Switzerland, so there are a couple of examples, Indonesia, so there are a couple of examples where
12:12this is an obligation.
12:14So back to your question, there's a limit to how naive you can be if you want to develop a
12:20business, because that's at the heart of getting the authorization to operate and to run your business in the countries
12:26where you would like to.
12:28But then once you are over this kind of MVP of requirements that are mandatory for you to open and
12:36operate, then, of course, I mean, that's everything that, Ana, what you said is completely, completely relevant.
12:42How does one anticipate these issues changing over time?
12:48In other words, you said that people began to wake up to the importance of data sovereignty during COVID.
12:54I'm just curious, if we fast forward five years, do we imagine that the kind of landscape in which companies
13:01like you are operating is going to get more complex or less complex?
13:05What's the what's the what's the movement in this I think is going to become more complex because A.I.
13:12is really accelerating all the trends.
13:15Why? I want you to can you explain? I want you to kind of do a little deep dive on
13:20that.
13:20Yes. What specifically is it about A.I. that's complicating this?
13:24That's a very good question. A.I. now moves from, you know, actions just being taken from, you know, somebody
13:33operating a system to the technology actually making decisions.
13:38Right. So you have to have a much better visibility of what systems A.I. is touching, what data it
13:47is accessing and where.
13:49Right. So you have to have that mapping much more clear because the stakes are higher now on how technology
13:55is actually operating your business.
13:58Right. So I do think that there is an acceleration because of that.
14:03The second element, A.I. is going to increase the amount of vulnerabilities that are going to be either identified
14:10or created.
14:11So you have to have an ability to continuously monitor, monitor and scan what is happening in the cybersecurity landscape
14:20so that you can prevent and react in a much faster way.
14:24So there are more elements of disruption that are coming up as a result of the acceleration of technology.
14:32I can give you a concrete example. So the way applications work today is pretty much deterministic.
14:42You have rules, you have data, you have processes very often embedded into the to the code, into the business
14:47logic.
14:48So that are executed. And very often, if you have the same input, you have the same output with and
14:56so you have, I mean, application with modules, you have APIs, you have data, you have, you know, beautiful mobile
15:02first front ends, you know, all these fancy things that we that we run on the cloud or on premium,
15:07whatever.
15:07So let's project yourself into a couple of years from now where the architecture is going to be agentic native
15:14with concepts such as headless applications.
15:17So you will interact with kind of prompt interface and you will start asking as a customer or as an
15:26employee or as a partner, you will ask interacting and asking a certain number of problems to be solved.
15:32And this is going to be given through tokens and all these technologies into an ecosystem of digital agents orchestrated
15:41and orchestrating activities, looking at what is in the in the rack in terms of what is the process telling
15:49me about how do I have to manage that?
15:51What kind of data do I have in my repository? And you enter into something which is going to become
15:56much more probabilistic.
15:57And you have LLMs there in the meantime, in the middle, trying to get answers, smart answers to queries that
16:06will come from specialized digital agents.
16:10So there's nothing to do with the way applications run today.
16:15And if you look at the flow of data today that we know, we know where the data are located,
16:22as I was saying, you know, a lot of things we know and how the data is going to flow
16:27in all the directions in this agentic native architecture.
16:30You understand that, as you said, that this is going to accelerate significantly and the need to understand the underlying
16:38stack and architecture in the sovereignty ecosystem is going to be crucial.
16:45You know, data can suddenly become public, public in the way they can be used to train models.
16:51And a little bit of your IP step by step is going to go into those models if they learn.
16:57If you are not careful, that's what is going to happen.
16:59Of course, there are ways to prevent that.
17:01But if you are not careful, you can suddenly see the world around you becoming more intelligent than you on
17:07your own business.
17:08It seems like there's a very kind of crude way of putting it, but there's a race going on with
17:16the technology and running one race.
17:18And then the other race is our ability to kind of make sense of it, have visibility in it, integrate
17:24the technology into the way we do our who's winning that race right now.
17:27Is it is it hard to keep up with the technology?
17:30That's why I think you need the technology to govern the technology, right?
17:35And to me, that is what our proposition with this platform that we launched a few weeks ago called Sovereign
17:43Core is to provide that tooling and those capabilities to help organizations create those capabilities.
17:50Because what we learned already is that, as Giovanni explained very well, the technology is going to accelerate exponentially.
18:00How do you map that with that same level of speed, only another technology that is going to operate at
18:09the same level of acceleration?
18:12And that is exactly the proposition that we have in supporting our clients.
18:16So that's the headache that we're trying to solve.
18:18Giovanni, do you, I'm assuming you've been in this field of technology for how many years?
18:25Oh, 30 years.
18:27Yeah.
18:28Is there any, I'm curious to compare the moment we're in to any previous moments.
18:32So you've now lived through several technological upheavals.
18:38How does this one compare to the ones earlier in your career?
18:41For me, this one is very clearly the one that has the highest potential.
18:48And in terms of speed, there's no precedent.
18:53Everything we've done in the past, where we've been trying to modernize, let's take a concrete example, modernizing business applications.
19:01We had this discussion a couple of months ago.
19:04So like all the companies in the world, we have legacy applications.
19:08All the companies have legacy applications that have been written, I don't know, 30, 50 years ago.
19:13And the journey to modernize those applications has been the last, let's say, the last 15 years, something like very
19:22often a five years ticket every time you wanted to modernize something, including migration and decommissioning.
19:31And every time we, even a year ago, every time we were thinking about how there's technology out there, we
19:36can go much, much, much faster.
19:39We've always been blocked.
19:40And we always came back to that unit of performance of the five years.
19:47And since this year, things have become potentially feasible, because that's the agentic revolution.
19:56Because then you can specialize agents like people in a team to split the process into subtasks.
20:02And everybody is going to be very smart and intelligent in solving a part of the problem.
20:07And then if you are good enough to orchestrate that towards an outcome, which could be an application, modernization, ABC,
20:14whatsoever, potentially, I'm saying potentially, but this is now technologically, we see that it can work.
20:20You can do that not only more than five years, but maybe, I don't know, a year and a half,
20:24two years, maybe a little bit less.
20:26Why not?
20:27I don't know.
20:27But you see, the difference is simply huge.
20:30I've never seen that before.
20:31Yeah.
20:32Yeah, I agree with that.
20:33But I think the compression that you're seeing in project delivery, in new products that you are releasing, updating versions
20:40of products, it's something that is absolutely unprecedented.
20:45Yeah.
20:45So the pace of innovation is happening very fast.
20:49And if we think that AI has already created a tremendous impact, let's wait for quantum, right?
20:54Which is going to even take this to another level.
20:59And the mix, the combination between...
21:01The combination of both.
21:01Yes.
21:02Can you address...
21:04There's a very interesting contradiction at the core of all this, which is that intuitively, we know that innovation thrives
21:12on openness, interconnectedness, you know, no borders, whatever.
21:17But data sovereignty makes us think very specifically and often, I would imagine, painfully about the reality of borders.
21:27How do you manage that contradiction?
21:31I think that is really the challenge that we are all facing right now, right?
21:35I don't think we have 100% clear answer yet.
21:40There are certain elements of the stack that clearly...
21:44I mean, trying to reinvent is actually going to be a reinvention of the wheel.
21:51Like, I mean, I'm not going to develop chips from scratch, for example, infrastructure from scratch.
21:58But there are other elements of the stack that I can get much better control, right?
22:02So, for example, to the point that Giovanni made before, where my data is sitting.
22:07What is the orchestration layer that I can implement so that I can bring the right player at the right
22:14time?
22:14So, look at the stack of technology that you are implementing and see what are the elements where, number one,
22:21it's feasible to achieve control.
22:23And number two, I know that it's something that I actually have to do to make my business resilient and
22:31focus on those, right?
22:32Because if you try to address the entire stack, or if you try to create a model that you basically
22:39build a fortress, that's not going to be even feasible for you to achieve, right?
22:46I normally say that sovereignty is not about building walls, it's about building bridges, right?
22:51It's how you really create those connections.
22:54I like the way you phrase it.
22:56That's exactly that, because at the end, if you put sovereignty as an architectural requirement when you do design, I
23:08don't say it's the key to this very difficult paradigm, but at least it's making choices easier.
23:18So, for example, if you don't put sovereignty as a business requirement, and you want to develop your business in
23:26the cloud, what you are going to do is probably look at the available features, native features from the cloud
23:33provider, you're going to use those features full speed to go as fast as possible, as efficient as possible, and
23:39get access to all the stack innovation and everything else.
23:41And the day you have a problem, you cannot switch, or it will take you five years and 500 million
23:49to switch.
23:50If you take the sovereignty as a requirement, by design, when you want to start the configuration of your stack,
24:02you ask yourself, what do I have to concretely put here as a configuration item if I want to be,
24:08for example, multi-cloud compatible?
24:11Or multi-cloud and on-prem compatible?
24:14What kind of additional technologies maybe I have to use in order to be able to, I mean, do some
24:21portability of some workload from one platform to another?
24:25Not because I want to do that every day, because it makes no sense, but if tomorrow I have a
24:29problem, I want to be sure that by design, I know what's the process I'm going to use to do
24:35that portability.
24:36So these are elements that, again, if you don't design your architecture using those elements, you wake up in the
24:45morning, you have a problem, and you have no solution except spending half a billion euros.
24:50So that's the first point I wanted to make.
24:54Now, the second point is, if you want to turn technology into a business outcome, at the end, you need
25:03to be very precisely activating a technology.
25:08You know, so at the end, you have to make a choice.
25:11Yes, I activate this feature, you know, and yes, I use this tech provider of this solution.
25:17At the end, you don't escape.
25:19And what it also allows to do is making sure that in this architecture-based design, you also make explicit
25:29what you buy from a tech provider and what you do yourself.
25:36And also, what you do yourself for how long, because you can try a certain number of things because you
25:42are not convinced that a certain number of technology providers out there are sufficiently cross, you know, cross cloud platforms,
25:52you know, and you don't want to end up into a lock-in situation.
25:56So you can say, I don't feel that it's mature enough, so I start doing it, but it's not because
26:03you start doing it yourself that you have to be stuck in that strategy of doing it yourself for 15
26:08years.
26:09Again, even if you start doing it yourself in the design of the way you do it yourself, you plan
26:15an exit door to be able to move into a solution from a tech provider when the strategy is mature
26:21enough.
26:22So that's the difficulty, and this is everyday discussions with discipline.
26:28What I always recommend to teams is make the things explicit.
26:33There's no right or wrong answer in an unlimited time frame.
26:38There is something that is best today for the company and may not be the case tomorrow.
26:42So let's make it explicit and don't miss that extra work, because it's extra work.
26:49This is not something that is coming really, it's not falling from the sky.
26:52This is extra work, but it's worth doing this job to be sure that at least we are always in
26:59this equilibrium, difficult equilibrium between accessing technologies and being sovereign, compatible by design.
27:06I think that just to stress, you saw that Giovanni used the word by design all the time, right?
27:13Because I think that intentionality is probably what's different from what we saw in the past on how companies were
27:19adopting innovation.
27:20It was very much driven by convenience and speed.
27:24And now you have to have convenience, speed and intentionality and understand that, you know, you have to have visibility
27:34on the decisions you're making and you have to keep your choices more open, right?
27:39And not just go one way or locking yourself in one single platform, because that is going to represent a
27:47major exposure for your business.
27:49Does this, I was curious when you describe the kind of challenges that come along with data sovereignty, does this
27:56alter the way that two of you work together?
27:59So I can imagine, I mean, companies, insurers have been working with IBM, I imagine, for as long as there
28:07have been insurers and as long as there have been IBM.
28:10But I mean, in this particular iteration, are we altering the nature of the relationship?
28:15Before I go specifically to the partnership with AXA, I'm going to give an example of what you're doing with
28:22another company,
28:23which I think illustrates very well the intention, the objective and the challenge, right?
28:30So we have a partnership with L'Oreal as well, right, which is the cosmetics company.
28:35And they were like, okay, foundational models, large language models are super powerful, right?
28:41But I invested 100 years in my company to build knowledge about building formula for cosmetics, right?
28:48I don't want to give that expertise, that knowledge away.
28:53So I want to train my own foundational model.
28:57Of course, they were not going to do the entire stack of training by themselves.
29:03So they partner with us, we provide research, we provide tooling that allows them to bring their data
29:09and create their own model based on an open source, pre-trained model.
29:14So these are the types of, you know, challenges that companies are facing.
29:19And to my point prior, what is really critical to the point that you don't want, you know, a third
29:25party to have visibility or access to?
29:28And when it comes to the relationship with AXA and many other of our clients, I think number one is
29:36transparency, right?
29:38They totally understand how our technology operates, what are the, you know, what are the elements that are part of
29:46our architecture that are going to connect with their systems?
29:50And trust becomes really a fundamental element.
29:54Giovanni said, there are things that I'm going to build, there are things that I'm going to buy.
29:57So who am I going to buy from?
30:00Does this company really understand sovereignty by design?
30:03It's part of the way that they architecture their solutions.
30:06I think those are the elements.
30:09And I think that's why this discussion is so important right now, because it also levels the playing field for
30:15us, right?
30:16We at IBM, we have always been a company focused on technologies for the corporate world to really implement mission
30:24critical workloads.
30:26So I think now people understand why we approach things the way we approach and why hybrid cloud, you know,
30:32giving companies the ability to access multiple providers, either on-prem or in the public domain, why we have approached
30:41our technologies in that characterization is because we are starting to see the challenges of not having a multi-cloud,
30:50hybrid cloud strategy can actually apply to your business.
30:53So I think that this is really what changes.
30:56I think that this is really what changes for us now.
30:57We are much more conscious on the risks and those have to be considered when you are making technical decisions.
31:06Yeah, I think, I mean, I can't agree more with what you said.
31:09That's at the heart of the relationship between a company like AXA and a strategic partner, technology partner like IBM
31:19and the others.
31:20I mean, if that understanding is not there, there is no way we are going to rely on that strategic
31:28partner to build whatever future strategic reorientation.
31:33And, and, and, and, and it's true that today we have a large variety of technologies running in production as
31:41an insurance company, like banks, we have mainframes running a lot of, a lot of business, you know, half of
31:49our core insurance transactions every day run on our mainframe.
31:56That is an IBM mainframe, but at the same time, we are full speed in the AI transformation.
32:03We have finished the cloud migration.
32:07And so that's, that's, and so in, in, in the portability I was talking about, we are also using technologies
32:15from, from IBM, so unlike many others.
32:17And, and so that's also the, the, the, the difficulty and of the relationship, but also the expectation.
32:24My expectation is to make sure that the tech partner in front of me understands my whole, my entire reality.
32:33Because it's very easy to come with a very fancy proposals on the very last, you know, item in the
32:40hype that everybody's always very happy to make very great presentations and a few demos, but this is not what
32:46is running the business every day.
32:48And being, being able to understand the full stack again, that's what is absolutely critical.
32:55I had asked you earlier about, was there anything particular about the insurance business when it came to this question?
33:04I want to come back to that a little bit because, you know, you've, both of you have talked about
33:10trust and transparency.
33:12Aren't trust and transparency pretty core considerations for an insurer?
33:17I mean, much more so than someone that's making children's toys or, you know, handkerchiefs.
33:25Talk a little bit about, can, can you revisit that question?
33:29Yeah, no, of course, I think you have a very good point.
33:32If I look at the notion of trust, as you said, insurance is about trust.
33:36The noble purpose of an insurance company, that's what I repeat every time I have the opportunity.
33:41You know, I'm so happy every morning when I wake up because I know what I'm waking up.
33:46Because AXA is there to help families, companies, or individuals when they face real difficulties.
33:56You know why you wake up every morning.
33:58You know why it's difficult.
34:00And this implies, as you said, the notion of trust.
34:04So, of course, for us, what it means?
34:06It means, one, we need to make sure you were talking about data, healthcare data in your initial intervention.
34:13We need to make sure, indeed, we know perfectly exactly where our data are stored and what kind of data
34:21we talk about.
34:22Where is it sensitive data, health data?
34:25Because we need to overprotect that in order to make sure that data that we have for our customers are
34:32not going to be made public.
34:33You know, it's our duty to do that.
34:35It's, again, a notion of trust.
34:36Our customers trust that we do that.
34:39Insurance companies are long-term companies.
34:42And if you don't have trust anymore, I mean, we're simply out of business.
34:46So, data is an important topic.
34:48But at the same time, we talked about cyber.
34:52You know, we have a very, very strong cyber team and cyber security practice that we use both, of course,
35:03to protect AXA, like many organizations.
35:05I mean, we all do that, of course.
35:07But also to help our customers protect themselves.
35:11And we have also used our skills to develop insurance products for companies to protect them against cyber risks.
35:21So, that's also our duty to say not only we develop those skills, but we also give that skill back
35:27via an insurance product to our customers because we want to help them.
35:31And then, of course, back to the notion of trust itself, if those elements are there, at the end, what
35:38we believe as an insurance company, and I agree with you, this is valid for the insurance sector in general,
35:44is that if we continue to demonstrate that we do that very seriously, our customers continue to have a lot
35:56of trust in us.
35:57And probably, with the AI revolution, the ones who will be able to be better, if I can use that
36:04word, will be the ones who will be able to continuously demonstrate that they always deserve the trust that they
36:12receive from their customers.
36:14So, yes, of course, this is specific.
36:16I mean, it's specific to the insurance sector, probably things also such as, I don't know, pharmaceutical companies, you know,
36:22things, activities where it's very, very sensitive.
36:27And, yeah, that's clear.
36:29Let me ask a question another way, and maybe, Ana, you can jump in here.
36:35These considerations might differ from industry to industry, but what about from big to small?
36:42Is this a more pressing issue for a multinational than it is for a startup?
36:49I think that this applies to all the companies, right?
36:53Especially because the startups from today are not like the startups from the past, right?
36:58Everybody is scaling so fast, right?
37:00You're seeing companies going from zero to billion in, like, months in the current world.
37:06All the startups in general, they operate in a global footprint.
37:13So, if I am a startup going into the, let's say, the healthcare, right, industry, I'll need to follow the
37:21regulations, even if I'm a very small startup, right?
37:24So, I do think that probably what is happening now is that this applies to different sizes, different industries, probably
37:33some more regulated than others.
37:36And going back to the point of Giovanni on insurance, I think insurance is probably the industry where this is
37:42much more visible because insurance is about pricing risk, right?
37:48And how do you price risk based on knowledge, based on probabilities, and that's all data, right?
37:53So, data is their product, I would say.
37:56But every company now will have to be watching those aspects because as they scale, even if they are small,
38:04they'll need to be meeting those requirements.
38:08What, if you were to chat with a founder who was just starting out, who came to you and said,
38:15what should I be doing about data sovereignty?
38:18What should I get right on day one?
38:20What would your advice be?
38:22I think now it's much easier because when you're starting from scratch, you can really design your solutions and your
38:29applications already with all that in your mind, right?
38:33So, all the points that Giovanni made before, by design, this is how you're going to design up front.
38:39Understand what industry you're operating in.
38:42Understand what are the implications of the data that you're manipulating.
38:46Map the risk and the critical mission applications that you're going to develop.
38:52Make sure that those are really like sovereign to the core and, you know, start the execution.
39:00And then if I can add on that, we have not been talking a lot about that.
39:06But if I look at Europe now, for example, encryption is very critical when you talk sovereignty.
39:14Everything you said is absolutely correct.
39:16But encrypt, that's an advice I would give.
39:19Is make sure, for example, that the management of the keys is yours.
39:24Is yours, you know, and do that from day one.
39:28Don't do that.
39:30Because when you do encryption, very often, that's what I was saying earlier.
39:34So, you have native services, for example, coming from the cloud providers.
39:38And you can encrypt using the native services.
39:43And they store the keys, of course, that have been used to do this encryption.
39:46And it's very comfortable.
39:49You can go very, you can be very fast.
39:54But you lose control.
39:56And so, that's a very simple trick that in the design, very often now, comes on a regular basis to
40:04say, pay attention.
40:05Of course, you can use the services.
40:08But again, storing the keys, the keys are yours.
40:11Then nobody can access your data.
40:15So, this is a really interesting theme that I'd love to sort of end on.
40:20Which is, it seemed like there was a moment in the evolution of technology where the trend was in the
40:26other direction.
40:27That you wanted to outsource as much as you could and just focus on a few things.
40:32But now you're talking about the importance of taking back control.
40:35Is that, am I right?
40:37Is this a shift across a number of different dimensions when it comes to technology right now?
40:42Yeah, I think technology now is so core to the business.
40:46It's so central to the strategy that you really have to take it like any other major component of your
40:54supply chain.
40:56And to me, that's the reason why we have this wake-up moment where people understand that I need to
41:03put much more control.
41:04I need to have much more visibility.
41:07And another topic that just from an advice standpoint on the previous question,
41:12another architecture that I would recommend significantly is to adopt containers on how you develop your applications.
41:20Because that gives you mobility of how your application navigates in multiple environments.
41:25So, but just to conclude on your question, it's a moment where technology now has become as important as energy,
41:34as important as other critical elements for you to operate.
41:40Yeah, absolutely.
41:41And the regulation itself is also creating, in a way, the obligation for us for certain activities to have those
41:55activities back under our control.
41:58You were talking about containers.
42:00That's, you know, completely...
42:02I know how much you like them.
42:05But, for example, if I look at DORA regulation, what is DORA regulation telling you?
42:12Understand your key business processes.
42:15Map those key business processes to your underlying technology.
42:19Check where you have concentration risks.
42:21Mapping again, starting from your very critical business processes.
42:26And once you have identified the areas where you have concentration, which is normal,
42:34plan strategies, write strategies, test strategies, on reversibility.
42:42And so this is...
42:44A couple of years ago, we were doing that on, I would say,
42:52just when we were feeling that something in a specific area of the architecture was a little bit strange.
42:58Then we were doing a deep dive, and we were very often arriving at the conclusion that probably there, we
43:04need to change something.
43:05Let's change the technology, create more portability, and bring the thing under control.
43:12But it was really sporadic.
43:14You know, it was not systematic.
43:16With the regulation now, it's mandatory.
43:19We are, as an insurance company, we have to demonstrate every year we do the job.
43:26So, you see, I think you are totally right in saying that we need to make sure we have a
43:31certain number of activities back under our control.
43:35But it's not only us deciding that.
43:38I think it's also regulations forcing us.
43:40And from that perspective, I to say this was a very good initiative.
43:42Yeah.
43:44It's interesting to me that when you started, Giovanni, in this field, you were probably either down the hall or
43:54on another floor.
43:55And now you have to be directly in the C-suite.
43:59I mean, over the course of your career, you've probably gone from being marginal to being essential, which is very
44:07fascinating.
44:07I'm wondering, did you anticipate that transformation?
44:12Not a little bit, yes.
44:15Because I've always been convinced that in reality, the more the world was going to modernize and digitize, the more
44:25the technology was going to be inevitable.
44:28But again, I've not anticipated the speed of the current description.
44:34That I've not anticipated.
44:35You know, I was thinking about some of the statements that I was making five years ago, announcing that a
44:43certain number of elements were going to happen probably in a five to five years time frame.
44:50In the meantime, it's over.
44:52We have already another disruption.
44:54You know, and I'm not talking 50 years ago.
44:56I'm just talking five years or 10 years ago.
45:00So, yeah, I always had that feeling that technology was going to be really critical.
45:05But I have to be honest and modest, not at the level it is today.
45:09Yeah.
45:10I think our time is up.
45:11I wanted to thank both of you for this fascinating conversation.
45:15The irony of this conversation is that I've been a journalist for several decades and I realized a few months
45:22ago that my data, in which case is just interviews, you know, interview tape and transcript, was scattered across a
45:29million different places.
45:30So I did my own version of this and I hired a 21-year-old to sit in my office
45:35and physically go through all my old archives.
45:37I do my own version of Malcolm Data Sovereignty is going on this summer, a lot less elaborate.
45:43Good practice.
45:44Good practice.
45:46Yes, that's good.
45:47But thank you very much for joining us on Smart Talks at IBM and good luck.
45:53And thank you all out there for coming and listening.