CASE STUDY
Data governance is even more fundamental. AI is only as reliable as the data and governance behind it. We are therefore looking at issues such as data quality, ownership, classification, access control, retention, privacy, auditability and appropriate use.
Responsible AI means that we have to be clear about what an AI system is allowed to do and what it is not allowed to do. We need controls around sensitive information, human oversight, accuracy, explainability and accountability. manage only traditional infrastructure. Our cloud journey is about creating a hybrid and increasingly cloud-enabled technology environment that is secure, resilient, economically sustainable and aligned to WEF ' s business requirements.
How are you balancing cloud adoption with requirements around data sovereignty, cybersecurity, resilience and the protection of sensitive financial and customer information?
We also recognise that cybersecurity has to be designed into the AI architecture from the beginning rather than added later.
The objective is to create an environment where innovation can happen safely. We do not want governance to become a barrier to innovation, but neither do we want innovation to outrun governance.
For WEF, the principle is simple: we want to move quickly, but we want to move responsibly.
What is driving the Fund’ s transition from on-premises infrastructure to the cloud, and what challenges have you encountered during the migration?
The transition to cloud is being driven by the need for greater scalability, resilience, availability and flexibility in how we deliver digital services.
The traditional on-premises model requires the organisation to carry significant responsibility for physical infrastructure, capacity planning, hardware lifecycle management, backup, redundancy and several other components of the technology stack.
Cloud gives us the opportunity to consume infrastructure and selected technology capabilities more dynamically. This is particularly important as WEF ' s digital services grow and demand becomes less predictable.
However, cloud migration is not simply a matter of moving servers from one location to another.
The real challenge is understanding the applications, integrations, databases, dependencies and business processes that sit behind those systems. Legacy applications may have been designed around an on-premises architecture, and moving them requires careful assessment.
We are therefore taking a progressive approach. We have to understand which workloads should move, which should be modernised, which should remain temporarily where they are, and which systems may need to be redesigned altogether.
Data migration is another critical area. We have to maintain data integrity and service continuity throughout the process. There is also a significant people component. The skills required to operate a modern cloud environment are different from those required to
For us, cloud adoption starts with risk, not technology. WEF handles financial and personal information, so we cannot make technology decisions without considering data protection, cybersecurity, regulatory obligations, business continuity and the sensitivity of the information involved.
Our technology strategy is aligned to WEF’ s broader 2023 – 2027 strategic direction: expanding financial access, strengthening institutional capacity and using technological innovation to improve socioeconomic empowerment. Technology has to translate into better outcomes for women entrepreneurs, not simply more systems.
Our approach is therefore based on classification and risk assessment. Not every workload has the same security or availability requirements. We need to understand what data we hold, where it resides, who should access it, how it moves between systems and what would happen if a particular system became unavailable.
Identity and access management is particularly important. We are moving towards stronger principles around least privilege, controlled access, authentication and monitoring.
We are also looking closely at encryption, backups, disaster recovery, security monitoring and incident response.
Resilience is another important consideration. Moving to cloud does not automatically make an organisation resilient. You still need properly designed architectures, tested recovery procedures, appropriate backup strategies and clearly defined recovery objectives.
Data sovereignty also needs to be considered as part of our architecture and procurement decisions. We have to understand where data is stored and processed, the contractual protections provided by technology providers, applicable legal and regulatory requirements, and the controls available to WEF.
The principle we are applying is that cloud is a delivery model, not a substitute for governance. •
16
INTELLIGENT CIO AFRICA www. intelligentcio. com