IT Governance Frameworks

The EU does have a tough job. Externally, on the world stage, competition is fierce, innovation is in demand, and scale wins. Internally, some believe it is better to keep dwarfs among dwarfs. It is easy to blame Brussels. It is more difficult to reach a better balance. And that means we need to reflect more on the ability to promote high investments in capital-intensive industries. And this includes digital infrastructure. We, telcos like Deutsche Telekom, have to be clear about our role: what is in for our customers, for Europe, and where we need help by governments. At the FT-Connect Europe Forum in Brussels I will try to be clear on this. It is good that Europe is moving from idea to delivery. The Digital Networks Act (DNA) is coming and must enable investment at scale. The EU is preparing a major shift in its approach to regulating digital infrastructure, with the forthcoming DNA aimed at addressing long-standing issues around investment, scale, and market fragmentation. If done right, the DNA might finally change the equation for investing companies through bold reforms: 1️⃣ Simplification/Deregulation In line with the recommendations of the Draghi Report, overlaps can be removed, frameworks simplified and harmonized. The needed overhaul of ex-ante rules should reflect new market realities and move towards ex-post approaches. Sustainable infrastructure-based competition is key. For example, in our Croatian market we have seen deregulation in fibre. As a result, customers have a wider range of choice at better prices. 2️⃣ Spectrum Our sector needs investment certainty through longer licenses. What about 40 years? And harmonized availability of spectrum? True as ever: every Euro paid in auctions is a Euro not invested in infrastructure. 3️⃣ Single Market / Scale Economies of scale in our industry are local rather than transnational. Moving towards a Single Telecoms Market requires first sufficient scale in-market through consolidation. We need a speed up in merger reform as announced by President Ursula von der Leyen. Apart from focusing on short-term price effects, merger rules should take into account long-term benefits of a merger on investment and innovation. In the current environment of geopolitics, we need stronger companies and industries in Europe. Telecom companies play a crucial role in Europe’s digitalization, not just for connectivity but in a variety of areas. We go for the cloud. For data centers. For gigafactories. For cybersecurity. For AI in so many respects. There is a new ecosystem emerging. There is the opportunity of Europe being an active part of it. And there is the risk of lacking commitment, lacking clear targets, or lacking investments. Let us be bold and seek quick, transparent decisions.

What’s the hidden cost of “waiting until next quarter” to fix your telco’s data stack? For telcos, the delay is rarely just technical. It’s strategic. Every month spent wrestling with siloed systems, fragmented governance, and architectural debt compounds your risk — and drains opportunity. Learn more about it here – https://lnkd.in/d8PyHj-2 That’s the central theme of Witboost’s latest whitepaper on Digital Transformation in Telecommunications, which I had a chance to review this week. It unpacks the 7 persistent challenges that telecom operators face — and why the status quo isn’t just inefficient, it’s unsustainable: - Network downtime costing $1.2M/hour - Redundant data initiatives increasing OpEx - Misaligned IT, data, and business teams stalling execution - Inability to use even 10% of the data they generate But what makes this paper powerful isn’t just the diagnosis — it’s the playbook for action. Here are three ideas that stood out to me: 1️⃣ From Centralized Governance to Computational Governance Legacy governance assumes a central authority can review everything. But that doesn’t scale. Computational governance applies policies at runtime, creating real-time compliance and freeing up teams to move faster. 2️⃣ Decentralization with Accountability Telcos must move toward domain-based decentralization. That doesn’t mean chaos — it means data product teams owning quality, access, and policy. This creates natural boundaries with clear responsibility. 3️⃣ Transformation via Use Case Pathways The report argues that “big bang” transformations rarely succeed. Instead, telcos should start with high-impact use cases (like churn reduction, AI-driven NOC analytics, or API monetization) and build maturity over 18+ months. The best part? It provides a maturity model and a realistic 3-phase roadmap—from laying the foundation to scaling and optimizing. This is essential reading for: CDOs and Chief Transformation Officers Heads of Architecture, AI, or Data Engineering Anyone leading platform modernization or customer experience in telecom 📘 Link to download the report: https://lnkd.in/d8PyHj-2 I’d love to hear: What’s one roadblock your org keeps running into when it comes to scaling data use in telco?

𝐃𝐚𝐭𝐚 𝐆𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐯𝐬 𝐀𝐈 𝐆𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐯𝐬 𝐀𝐈 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐯𝐬 𝐀𝐈 𝐄𝐭𝐡𝐢𝐜𝐬 𝐚𝐧𝐝 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 Four domains, massive overlap, and most organizations treat them as one thing.  They are not.  Each serves a distinct purpose and skipping any one creates blind spots that compound fast. DATA GOVERNANCE (The "Foundation") The bedrock everything else sits on. - Data Quality Management - Data Cataloging and Metadata - Data Stewardship and Ownership - Data Lineage and Provenance - Master Data Management (MDM) - Data Dictionaries and Business Glossaries - Data Silo Elimination - Data Democratization and Access Policies - Data Architecture and Integration - Data-to-Model Lineage AI GOVERNANCE (The "Operating System") - AI Model Registry and Inventory - AI Literacy and Training Programs - AI Steering Committee / Board Oversight - Model Lifecycle Management (Build to Deploy to Monitor to Retire) - Roles and Responsibilities (RACI for AI) - Vendor and Third-Party AI Oversight - AI Acceptable Use Policies - Continuous Model Monitoring and Alerting - Model Drift Detection and Remediation - Incident Response Playbooks for AI - Conformity Assessments AI SECURITY (The "Shield") - Data Encryption - Data Poisoning Prevention - Adversarial Input Detection - Embedding Inversion Attack Defense - AI Supply Chain Security - Inference Endpoint Security - AI-Specific Penetration Testing / Red Teaming - RAG Pipeline Security - Agent Privilege Escalation Prevention - OWASP Top 10 for LLMs and Agentic Apps - Output Filtering and Content Safety Guardrails AI ETHICS AND COMPLIANCE (The "Moral + Legal Compass") - ISO/IEC 42001 Certification - Transparency and Explainability (XAI) - Accountability and Ownership - Human Oversight - AI Impact Assessments - Privacy-Preserving AI (Differential Privacy, Federated Learning) - Deepfake Detection and Labeling Mandates - GDPR / CCPA / LGPD Adherence - Mandatory Bias Audits (e.g., NYC Local Law 144) - Fairness and Bias Mitigation - Human Dignity and Rights - Right to Explanation THE NUMBERS - 62% of orgs say lack of data governance is the number one barrier to AI initiatives - Only 34% of enterprises have AI-specific security controls (Cisco) - AI security incidents rose 56.4% from 2023 to 2024 (HAI) - 77% of employees using AI have pasted company data into a chatbot (LayerX) - By 2027, 3 out of 4 AI platforms will include built-in responsible AI tools - By 2030, AI compliance spend will hit $1B globally HOW THEY CONNECT Data Governance feeds AI Governance with clean, traceable data.  AI Governance operationalizes policies that AI Ethics and Compliance defines.  AI Security protects all three layers from threats.  Skip one and the others weaken. PS: If you found this valuable, join my weekly newsletter where I document the real-world journey of AI transformation. ✉️ Free subscription: https://lnkd.in/exc4upeq #AIGovernance #DataGovernance #EnterpriseAI

Projects get completed. Transformation stays invisible. A CEO said this to me: "Rob, our projects are being delivered. Our teams are celebrating, which I love to see. But nothing is actually moving our bottom line." That pattern is everywhere. High activity. Strong delivery. Limited enterprise impact. Projects matter. They always have. Strong delivery matters too. Transformation fails without both. It's like a football team at the World Cup celebrating possession stats, while losing the match. Projects are designed to deliver: • scope and milestones • timelines and outputs • predictable delivery That discipline matters. Projects rarely govern things like: • decision rights and escalation authority • cross-functional orchestration • enterprise value realisation • executive sponsorship alignment • institutional learning and transformation memory • behavioural and cultural standards Those are enterprise governance problems. Not project management problems. And they need an owner. Value realisation can't sit with whoever delivered the project. It has to sit with someone accountable long after the project closes. Enterprise transformation requires a different governing logic. Not a replacement for projects. A layer above them. Projects stay the engine. Governance decides what the engine is building towards. Because transformation isn't about completing work. It's about changing how the enterprise creates and captures value. When governance becomes too project-led: • Teams defend scope • Learning is treated as deviation • Delivery replaces value • Projects close while capability fails to develop So dashboards stay green. Presentations look impressive. Recognition follows. But the business barely moves. Projects are essential delivery vehicles. So are programmes. But transformation requires enterprise-level governance, led by leaders who stay accountable for value, not just for delivery. That means governing: • value realisation • operational change • strategic adaptation • capability creation • ownership beyond project close This isn't a template to apply regardless of context. It's a governing logic, applied with judgement. Because the goal isn't to simply complete projects. The goal is to build an organisation that operates and performs differently over time. Get The Boardroom Brief Insights for leaders shaping transformation https://cxo.fm/news

I just got back from a conference on #AI governance and something clicked while I was on a panel. It was like a lightbulb moment. 1️⃣ AI #governance isn't a technical issue. It's not a legal issue. It's not a compliance issue. AI governance is change management. 2️⃣ Companies are #hiring for it all wrong. I've been watching AI governance job descriptions for months now. They all sound like this: "We need someone who can write Python, audit #algorithms, interpret the EU AI Act, AND build risk frameworks, AND speak to the board about AI strategy." Then they offer $110k. For a unicorn. Who doesn't exist. And if such a purple, curly-haired squirrel does exist, it's working for the big dawgs, like Anthropic or OpenAI or Google. Here's what I said on the panel: You don't need a data scientist who became a lawyer in between consulting gigs. You need someone who can translate between the people who build AI and the people who govern it. AI governance is bilingualism. You need someone who can sit in a room with engineers and understand what they're building. Then walk into a compliance meeting and explain why it matters. Then brief leadership on what decisions need to be made. That's neither purely technical nor purely legal. That's change management. You know, what they used to call "soft skills"? Your AI governance 'problem' is NOT that you don't have enough policies. It's that nobody's reading them. Your problem isn't that you don't have technical guardrails. It's that nobody knows what they're protecting or why. Policy without engineering is aspiration. Engineering without policy is chaos. AI governance lives in the middle. And the middle is messy. It's convincing your product team that governance isn't a blocker, it's a strategy enabler. It's teaching your compliance team that "we're compliant" doesn't mean you're safe. It's building frameworks that people actually use instead of PDFs that live in SharePoint and die there. Remember Sharepoint??? That's change management work. And we keep hiring for it like it's a technical or legal role, or both in one. And we throw $120k in max. In NYC, 5 days a week in-office. The people who will succeed in AI governance are those who can make people care enough to change how they work. If you're building an AI governance team and you're looking for someone who checks every technical and policy box, you're going to be looking for a long time. Or you're gonna fall for the one who can whisper sweet nothings in your ears but has no substance. But if you're looking for someone who can walk into a room, understand the problem, translate it for five different stakeholders, and get people to actually do something differently? That's the role. That's AI governance. If you need help with hiring, or getting hired, in AI governance, holla at me. My DMs are open. Sharing some pics from the awesome conference! #AIgovernance #changemanagement #hiring #AIjobs #algorithmsarepersonal

Navigating the Intersection of Technology, Risk and Governance : 🔸 In the modern boardroom, the siloed approach of considering "IT issues," "compliance", "corporate strategy", "financial numbers" as distinct chapters is retreating. ✔️ As an advisor and Independent Director specializing in #TechReg , cyber and governance, I spend my time at the intersection of these three forces. In the automated, AI-driven world where #innovation needs to match steps with #trust, these forces are merged into a single, complex narrative, where the Boards need to view TechReg not as a hurdle, but intertwined onto the financial, risk and strategy discussion rooms (or committees) as gear-throttle-break that can take the business forward in the desired speed. 🔸 The "governance" piece is currently being tested by Generative AI. We are at crossroads where the pressure to adopt AI to stay relevant is clashing with the need for ethical guardrails and data integrity. ✔️ I advocate a "Governance by Design" framework, wherein oversight and controls are considered and incorporated at the inception of a project, rather than as a bolt-on after say, the software has been deployed. 🔸 Cybersecurity has graduated from the server room to the boardroom, thanks to the guidelines / mandates from key Indian regulators such as RBI, SEBI, IRDAI. However, the challenge I still see is the use of technical jargon, whereby conversations may get stuck. ✔️ I often play the role to 'translate' such tech terms into business and fiduciary 'English'; example "zero-trust architecture" and "endpoint detection" into automated controls built in to ensure that users need to prove their approved rights and authority to access systems, and, controls in the employees' systems to monitor, detect, intimate for any virus, malware etc. 🔸 Effective #cyber #governance involves asking not just questions such as 'are we secure'. ✔️ I help the Boards review detailed presentations, with impact analysis, financial numbers, risk rating et all, on say, how long can we survive a total systems outage, and steps-roles-procedures to recover from the same. ✔️ As an Independent Director, my goal is to ensure that the Board doesn't just "oversee" technology and financial ratios but truly understand how they should talk in sync and become a fundamental value driver in a digital first business. 🔸 With the world moving towards prescriptive technology regulation in the face of increasing number and category of threats, whether RBI, SEBI, IRDAI, DPDP Act and international rules such as DORA, EU AI Act et all, #compliance has moved from a back-office function into competitive advantage. ✔️ I help the Board to take a multi-directional lens to assess, say, how tech scalability and operational risk appetite fit into the 5-year business growth plan; to build the bridge between tech governance and financial balance sheet. #cyberboarddirector #cybersecurity #technology #riskmanagement #digitaltransformation

As businesses integrate AI into their operations, the landscape of data governance and privacy laws is evolving rapidly. Governments worldwide are strengthening regulations, with frameworks like GDPR, CCPA, and India’s DPDP Act setting higher compliance standards. But as AI becomes more embedded in decision-making, new challenges arise: 🔍 Key Trends in Data Governance & Privacy Compliance ✔ Stricter AI Regulations: The EU AI Act mandates greater transparency, accountability, and ethical AI deployment. Businesses must document AI decision-making processes to ensure fairness. ✔ Beyond GDPR: Laws like China’s PIPL and Brazil’s LGPD signal a global shift toward tougher data protection measures. ✔ AI and Automated Decisions Scrutiny: Regulations are focusing on AI-driven decisions in areas like hiring, finance, and healthcare, demanding explainability and fairness. ✔ Consumer Control Over Data: The push for data sovereignty and stricter consent mechanisms means businesses must rethink their data collection strategies. 💡 How Businesses Must Adapt To remain compliant and build trust, companies must: 🔹 Implement Ethical AI Practices: Use privacy-enhancing techniques like differential privacy and federated learning to minimize risks. 🔹 Strengthen Data Governance: Establish clear data access controls, retention policies, and audit mechanisms to meet compliance standards. 🔹 Adopt Proactive Compliance Measures: Rather than reacting to regulations, businesses should embed privacy-by-design principles into their AI and data strategies. In this new era of ethical AI and data accountability, businesses that prioritize compliance, transparency, and responsible AI deployment will gain a competitive advantage. 𝑰𝒔 𝒚𝒐𝒖𝒓 𝒃𝒖𝒔𝒊𝒏𝒆𝒔𝒔 𝒓𝒆𝒂𝒅𝒚 𝒇𝒐𝒓 𝒕𝒉𝒆 𝒏𝒆𝒙𝒕 𝒘𝒂𝒗𝒆 𝒐𝒇 𝑨𝑰 𝒂𝒏𝒅 𝒑𝒓𝒊𝒗𝒂𝒄𝒚 𝒓𝒆𝒈𝒖𝒍𝒂𝒕𝒊𝒐𝒏𝒔? 𝑾𝒉𝒂𝒕 𝒔𝒕𝒆𝒑𝒔 𝒂𝒓𝒆 𝒚𝒐𝒖 𝒕𝒂𝒌𝒊𝒏𝒈 𝒕𝒐 𝒔𝒕𝒂𝒚 𝒂𝒉𝒆𝒂𝒅? #DataPrivacy #EthicalAI #datadrivendecisionmaking #dataanalytics

Governance and change management / change leadership will make or break your CX efforts. Here's what you need to do now if you don't have these topics locked down: 1. Establish a clear governance framework Ensure there is clarity around who is responsible for decision-making, execution, and oversight of CX initiatives. Develop and enforce policies, standards, and best practices that guide the implementation and maintenance of CX strategies. Form committees that include representatives from key departments to oversee and ensure alignment with organizational goals. Make sure these governance forums ladder up to more senior forums, so you're leveraging and aggregating what's already been done. 2. Foster strong leadership and stakeholder engagement Secure active sponsorship and commitment from senior leadership to drive CX initiatives. Engage stakeholders across different functions to ensure broad support and alignment with CX goals. Maintain open lines of communication to keep stakeholders informed and involved in the change process. 3. Implement robust change management practices Adopt a structured change management framework (e.g., ADKAR, Kotter’s 8-Step Process) to guide transitions. Provide training programs to equip employees with the skills and knowledge needed to embrace and implement changes. Establish metrics and KPIs to monitor the progress of change initiatives and make data-driven adjustments as needed. 4. Develop a comprehensive risk management plan Conduct thorough risk assessments to identify potential challenges and obstacles to CX initiatives. Develop strategies to mitigate the identified risks, including contingency plans for various scenarios. Regularly review and update the risk management plan to address new risks and changing circumstances. 5. Leverage technology and data analytics Implement strong data governance practices to ensure data quality, security, and compliance. Utilize advanced analytics to gain insights into customer behaviors, preferences, and feedback to inform decision-making. Ensure seamless integration of CX technologies with existing systems to streamline processes and enhance efficiency. What are you doing to ensure your governance and change management / change leadership efforts are best-in-class? #customerexperience #changemanagement #changeleadership #business

❓ The technology may be able to help you transform, but how do you assess if the company has the internal capability to support the transformation?   Question received during the webinar "Experience GROW with SAP" (recording 👉 https://lnkd.in/gv-KWHKy) The successful implementation of transformation requires an understanding of an organization’s readiness to change. Identifying and evaluating the factors that affect an organization’s ability to adapt to new processes, technology & workflows. ☝ If you are asking this question - you are already on a right track. Majority of change initiatives fail, because we fail to do a first step - assess, if the ambition and organizations CAPABILITY and CAPACITY to support the transformation is there. ** Capability can be built, borrowed or bought. But more important, has organization capacity to do this on top of business as usual? ** Capacity means all leaders, employees and stakeholders are giving priority, focus and attention to transformation. Coming back to the initial question about assessing capabilities and readiness for change 👇 I, personally, like the ** Business Transformation Management Methodology ** (BTM2), which offers a comprehensive framework to address various facets of business transformation, including assessing a company's internal capability to support transformation efforts. According to BTM2, evaluating a company's readiness and capability for transformation involves multiple dimensions, such as organizational structure, culture, employee skills, technological infrastructure, and existing processes. More about this methodology by Rob Llewellyn here >> https://lnkd.in/gKEzbPyp Top 7 capabilities: 1️⃣ Strategic Visioning and Alignment: Are you able to define a clear and simple "Case for change"? The "Why". Defining a compelling transformation vision aligned with business strategy and ensuring stakeholder commitment is essencial. If people don't understand the why - stop here. 2️⃣ Leadership and Governance: Does everyone understand that to run the Transformation you need a proper governance structures, strong leadership who can inspire teams through change. 3️⃣ Change Management: Managing organizational change effectively, addressing resistance, and fostering adaptability needs focus. Are you ready? 4️⃣ Risk Management: How good is organization to understanding and managing risks? 5️⃣ Process Management: You will need End-to-End process definition and management. Do you run your business in functions or you talk processes? 6️⃣ Technology Management: How strong is your Technology team? You need a leader who can build bridge between Business & Technology. 7️⃣ Talent and Competency: Ensure your core team has experience to handle changes. Best is to hire someone who already went the same way at least once. Don't try to learn from your mistakes. How would you assess readiness? #sappartner #BTM2 #transformation