Showing Posts From

Cloud

Seeing opportunities with AI

Artificial Intelligence (AI) is changing the way businesses operate, offering new opportunities and challenges. As a C-level executive, it's important to understand how AI can benefit your company while managing the risks involved. Setting Your AI Goals First, you need to decide what you want to achieve with AI. Do you want to use it to improve internal processes or to create new products and services? Your ambition will guide your strategy and set realistic goals. For example, AI can help streamline back-office tasks, making them faster and more efficient. Or, you might use AI to offer personalized customer experiences, which can lead to higher customer satisfaction and loyalty. Choosing the Right Approach Next, consider how you will implement AI. There are different ways to do this. You can use pre-built AI tools that are already available. This is quick and doesn’t require much technical knowledge, but it may not fit your specific needs perfectly. Alternatively, you can adapt existing models with your own data to make them more tailored to your business. This approach is more flexible but requires more expertise. Lastly, you can develop your own AI system from scratch. This gives you full control but is more expensive and time-consuming. Choosing the right path is crucial. It affects how quickly you can start using AI and how much it will cost. For instance, if your goal is to quickly improve customer service, a pre-built solution might be the best choice. If you need a highly customized solution for a specific problem, developing your own AI system might be necessary. Navigating the Risks Using AI also comes with risks. These include unreliable outputs, data privacy issues, cyber threats, and regulatory concerns. For example, AI systems can sometimes produce incorrect or unexpected results. This can happen if the data used to train the AI is flawed or if the system encounters new situations it hasn’t seen before. Ensuring data privacy is crucial, especially when handling sensitive information. You need to comply with regulations like GDPR in Europe or HIPAA in the U.S. Cyber threats are also a concern. AI systems can be targeted by hackers, putting your data at risk. This means you need to have robust cybersecurity measures in place. Additionally, different countries have different rules about AI, and you need to follow them. This can be complex, as regulations can change quickly and vary widely. For instance, regular audits and compliance checks can help ensure you stay within legal boundaries. Leading with Vision and Prudence Leading with AI requires a balanced approach. You need to support innovation while also ensuring safety and ethical considerations. This involves engaging stakeholders, balancing speed and caution, and fostering a culture of learning. Engaging stakeholders means talking to everyone involved, from developers to end-users, to get their input and support. This helps build a sense of ownership and alignment. Balancing speed and caution is also important. You need to move fast to stay ahead of competitors but take time to ensure your AI is reliable and secure. Fostering a culture of learning means encouraging your team to learn about AI and keep up with new developments. This helps keep your organization ahead of the curve. Wrapping Up AI offers a unique chance for C-level executives to drive growth and innovation. However, it also presents significant challenges. By carefully planning and managing risks, you can use AI to improve your business and stay ahead of the competition. In summary, leading with AI means setting clear goals, choosing the right deployment strategy, and being prepared for risks. With the right approach, you can unlock the full potential of AI for your organization. True leadership means guiding your company through the complexities of AI with vision and resilience.

Large vs. Small Language Models: Understanding the differences and choosing the right tool

In the early days of generative artificial intelligence, tech companies believed one main rule: bigger is always better. Massive AI models like OpenAI's GPT-4, Google's Gemini Ultra, and Meta's Llama-3 proved that adding hundreds of billions of parameters unlocked incredible skills. These models could solve complex logic problems, write software, and translate languages easily. However, a new trend is taking over the tech world: Small Language Models (SLMs). Models such as Microsoft's Phi-3, Google's Gemma, and Meta's Llama-3-8B show that smaller models can also be smart, fast, and much cheaper to use. To understand the AI landscape today, models are generally divided into three main categories:Large Language Models (LLMs) [70B+ Parameters]: Massive models trained on huge amounts of internet data. They require powerful cloud servers to run and act as general-purpose experts. Medium Language Models [13B to 70B Parameters]: Balanced models that offer strong reasoning skills while still being easier for companies to host privately. Small Language Models (SLMs) [1B to 10B Parameters]: Compact models designed to run efficiently on small hardware, such as regular laptops, smartphones, or small internal company servers.Hardware constraints: Why model size matters To understand why SLMs are becoming so popular, we need to look at computer hardware, specifically graphics memory (VRAM) and speed. Memory requirements (VRAM) To run an AI model, its weights (parameters) must be loaded directly into a computer's high-speed graphics memory.A large 70-billion parameter model needs around 140 GB of VRAM to run at standard quality. This requires high-end enterprise hardware costing tens of thousands of dollars. In contrast, a small 8-billion parameter model can be compressed (quantized) to run using less than 5 GB of VRAM. This means it can easily run on a standard work laptop or a modern smartphone.Speed and latency Big models need to move massive amounts of data back and forth through hardware every time they generate a word. Smaller models carry much less data, which allows them to generate text much faster. This makes SLMs ideal for real-time tasks like live customer chat or typing assistance. How small models get so smart How can a small model perform almost as well as a giant model from a few years ago? The secret lies in high-quality data and smart training techniques. Traditional LLMs learn from raw internet text (billions of webpages, social media posts, and slang). Modern SLMs, on the other hand, learn from curated, high-quality "textbook" data and simplified lessons from larger models.Filtered Synthetic Data: Instead of learning from random internet chatter, modern SLMs are trained on clean, high-quality data created by larger AI models. This includes clear coding examples, textbooks, and step-by-step logic exercises. Knowledge Distillation: This is a process where a large "Teacher" model helps train a smaller "Student" model. The student learns to copy the reasoning patterns of the teacher without needing the giant memory size.Key differences at a glanceFeature Large Language Model (LLM) Small Language Model (SLM)Model Size 70B to 1 Trillion+ parameters 1B to 10B parametersHardware Needed Massive enterprise GPU servers Standard laptops, phones, single GPUsMemory Footprint Very High (100GB+ VRAM) Low (2GB to 10GB VRAM)Response Speed Slower for large answers Extremely fast generationOperating Cost High cloud API or server fees Very cheap to host locallyData Privacy Data usually sent to the cloud Data can stay fully on your local deviceCombining SLMs with company data (RAG) Many organizations assume they need a giant AI model to understand their company's internal files. However, using an AI model as a giant memory bank is inefficient and often leads to false answers (hallucinations). Instead, smart companies combine Small Language Models with a system called Retrieval-Augmented Generation (RAG):Step 1: User asks a question. Step 2: The system searches internal company documents for the facts. Step 3: The exact document text is given to the SLM. Step 4: The SLM reads the text and writes a clear answer.Because the SLM does not need to memorize all company facts inside its parameters, a small 8B model paired with RAG often outperforms a large, expensive LLM at a fraction of the cost. When to choose an LLM vs. an SLM Choosing the right model depends on your specific goals, budget, and privacy requirements. Choose a Large Language Model (LLM) when:You need complex reasoning: Writing complicated software code, analyzing vague legal documents, or solving advanced scientific problems. You build autonomous agents: AI systems that need to plan multiple steps and interact with external tools independently. Your queries are unpredictable: Your application covers many completely different subjects without a fixed focus.Choose a Small Language Model (SLM) when:Speed is critical: Applications like real-time translation, autocomplete, or instant customer support. Privacy is mandatory: Healthcare, finance, or legal tasks where data cannot leave the local building or device. You operate on a budget: Running high volumes of daily requests without paying expensive cloud API subscription fees.Closing thoughts Artificial intelligence is no longer just about building the largest possible model. While giant LLMs remain important for cutting-edge research and complex logic, Small Language Models are proving to be the most practical choice for daily business operations. By using clean training data, clever optimization, and targeted document systems, SLMs deliver fast, private, and cost-effective performance. The best AI architecture is not about using the biggest model available, but finding the smallest model that can solve your problem effectively.

The ungoverned cloud: Why cloud strategies fail at execution.

In boardrooms across Europe, cloud strategy is undergoing a harsh reality check. For years, the narrative was centered on speed and migration. Today, executive teams face a very different set of challenges: unpredictable cloud expenditure, strict regulatory mandates (NIS2, BIO2, EU AI Act), and diffuse operational accountability. When external audits reveal that two-thirds of cloud environments lack proper control, the executive reflex is predictable: install a heavy Governance Board, write 80-page policy manuals, and require manual sign-offs for every change. This approach fails every time. It creates shadow IT, paralyzes delivery teams, and fails to eliminate actual risk. Personally, I view cloud governance not as a bureaucratic brake, but as an operational operating system. True governance provides clear guardrails, automated compliance, and organizational clarity—allowing engineering teams to move fast safely. To achieve this, organizations must move away from theoretical policies and implement a functional Cloud Center of Excellence (CCoE).The 5 pillars of cloud governance Before structuring your team, you must define what cloud governance actually encompasses. Mature cloud governance covers five distinct operational domain pillars:Pillar 1: Financial Management (FinOps)Shifting from static annual IT budgets to dynamic unit economics, continuous cost allocation, and real-time optimization.Pillar 2: Security & Regulatory Compliance (NIS2 / BIO2)Enforcing baseline controls aligned with NIS2, BIO2, ISO 27001, and GDPR across all cloud landing zones.Pillar 3: Automation & Platform EngineeringEliminating manual infrastructure configuration through Infrastructure as Code (IaC) and automated developer platforms.Pillar 4: Identity & Data Control (Zero Trust)Implementing Zero Trust architecture, strict least-privilege principles, and explicit data boundaries.Pillar 5: AI & Emerging Tech Governance (ISO/IEC 42001)Setting parameters for responsible AI use under the EU AI Act and ISO/IEC 42001, preventing unmanaged shadow-AI implementations.What is expected of C-level leadership? Cloud governance cannot be delegated away to IT or a compliance team. Real governance requires active C-level involvement, clear sponsorship, and strategic alignment. Here is what is explicitly expected of executive leadership across each core domain:C-Level Role Core Executive Expectation & Operational ResponsibilityChief Executive Officer (CEO) & Board Treat Cloud Governance as Risk Management: Recognize that cloud failure, data breaches, and non-compliance carry direct board liability under NIS2. Establish risk appetite boundaries and mandate cross-functional governance across the company.Chief Operating Officer (COO) Align the Operating Model & CCoE Mandate: Provide the CCoE with formal authority to set organizational standards. Break down functional silos between IT, Security, and Business units, ensuring that delivery speed never bypasses compliance.Chief Financial Officer (CFO) Enforce Financial Accountability (FinOps): Shift financial oversight from traditional CapEx IT depreciation to dynamic OpEx management. Demand unit-cost transparency and require Business/Product Owners to account for cloud consumption within their P&L.Chief Information / Technology Officer (CIO/CTO) Drive Modern Architecture & Enablement: Transition engineering teams away from manual ticketing towards self-service platforms (IDPs). Enforce "Policy as Code" and ensure cloud infrastructure aligns with architecture goals.Chief Information Security Officer (CISO) Automate Guardrails Over Gatekeeping: Move from reactive security reviews to proactive, automated policy enforcement. Integrate NIS2, ISO 27001, and AI compliance directly into deployment pipelines.Key Leadership Takeaway: Executive leadership is not expected to manage cloud settings or review code. Leadership is expected to set parameters, grant mandate, enforce accountability, and model the culture required for operational discipline.Enablement, not control The central execution engine of cloud governance is the Cloud Center of Excellence (CCoE). Too many companies misinterpret the CCoE as an architectural approval committee that meets every Thursday to review tickets. That is the quickest way to kill organizational momentum. Gatekeeper vs. EnablementAnti-Pattern: The Gatekeeper CCoE Modern Pattern: The Enablement CCoEManually reviews and approves architectural change requests. Builds automated guardrails and self-service templates.Writes static policy PDFs that engineers rarely read. Embeds policy directly into deployment pipelines (Policy as Code).Acts as a centralized bottleneck for cloud adoption. Functions as an internal product team serving delivery teams.Measures success by policy compliance and audit logs. Measures success by engineering velocity, security, and cost efficiency.Structure & core roles A successful CCoE is a lean, cross-functional team that brings together key domains. It does not replace engineering teams; it empowers them.Executive Sponsor (COO / VP Operations): Secures budget, aligns governance with corporate P&L goals, and resolves organizational friction between business units. Cloud Lead / Architect: Defines overall multi-cloud strategy, Landing Zone standards, and reference architectures. Cloud Security & Risk Specialist: Translates regulatory requirements (NIS2, ISO 27001, EU AI Act) into actionable security policies and automated checks. Platform Lead / Software Architect: Drives Platform Engineering, building Internal Developer Platforms (IDPs) and self-service "Golden Paths". FinOps Practitioner: Analyzes cloud consumption data, establishes unit-cost metrics, and works directly with product owners on cost accountability.Practical implementation: A 4-phase roadmap Implementing cloud governance across an organization requires a phased, practical approach. Phase 1: Establish the charter & landing zone architectureDefine the CCoE Charter: Formally declare the team's purpose, scope, and mandate across the business. Build Landing Zones: Create standard multi-account cloud structures (e.g., AWS Organizations or Azure Management Groups). Isolate workloads by environment (Dev, Test, Prod) and business unit. Implement Centralized Logging: Ensure audit trails, identity logs, and network traffic are automatically ingested into a central SIEM system from day one.Phase 2: Automate guardrails (Policy-as-Code)Define Preventive & Detective Controls: Use native cloud policies (e.g., Azure Policy, AWS Service Control Policies) to enforce mandatory constraints: Preventative: Block public S3 buckets or unencrypted storage volumes from ever being created. Detective: Automatically flag and alert security teams when a resource drifts from baseline configuration.Tagging Strategy Enforcement: Mandate metadata tags (Owner, CostCenter, Environment, DataClassification) at deployment time. If a resource lacks tags, auto-remediate or reject the build.Phase 3: Platform engineering & self-service (Golden Paths)Build the Internal Developer Platform (IDP): Provide engineering teams with a self-service portal (e.g., Backstage) to provision compliant infrastructure in minutes. Publish Golden Paths: Pre-package approved architectures (e.g., secure microservice deployment, compliant SQL cluster) that include security, monitoring, and backups by default. Community of Practice: Establish cloud guilds to train product teams, share best practices, and accelerate internal skills development.Phase 4: FinOps maturity & Responsible AI governanceShift-Left Cost Management: Integrate cost-estimation tools into CI/CD pipelines so developers see the estimated monthly bill before merging code. Establish AI Guardrails: Deploy private API endpoints for Generative AI. Ensure corporate data is isolated and protected under strict tenant boundaries. Continuous Executive Dashboards: Provide board-level visibility into compliance posture, operational risks, and cloud cost efficiency.What the board needs to see To ensure your CCoE is delivering real value, track concrete operational metrics rather than subjective milestones:Metric Target / Good Practice Executive FocusLanding Zone Coverage > 95% of workloads in governed Landing Zones Risk & ComplianceUntagged Cloud Resources < 2% of total cloud assets Financial AccountabilityPolicy Drift MTTR < 4 hours to remediate non-compliant resources NIS2 / Security PostureGolden Path Adoption > 80% of new microservices deployed via IDP Velocity & StandardizationCloud Unit Cost Decreasing cost per business transaction P&L & ScalabilityClosing thoughts Solving cloud governance is not a technical problem; it is an organizational design challenge. Relying on manual audits, reactive firefighting, and bureaucratic approvals inevitably leads to higher costs and increased business risk. True operational leadership means building a system where compliance, security, and cost control are automated and frictionless. By establishing a modern Cloud Center of Excellence, embedding Policy as Code, and adopting Platform Engineering, executive teams can bridge the gap between high-level strategy and ground-level execution. When governance is built directly into your operating model, compliance stops being a burden—it becomes a competitive advantage that enables rapid, resilient, and profitable growth.

When intelligence becomes something we outsource

We are slowly doing something unusual with intelligence. Not replacing it. Not augmenting it. But outsourcing it. One prompt at a time. Artificial Intelligence tools like ChatGPT, Gemini, and Claude are often framed as productivity multipliers. And they are. They compress time, reduce friction, and make complex outputs accessible at almost no cost. But there is a quieter shift underneath that narrative. We are starting to separate thinking from understanding. And that is where things become fragile. The illusion of competence A well-written prompt can produce a remarkably convincing answer. Structured, fluent, confident, even nuanced. But confidence is not the same as correctness. And fluency is not the same as comprehension. The problem is not that AI produces wrong answers. It is that it produces answers that feel right often enough that we stop checking. And once that habit sets in, something subtle changes: We stop being the system that verifies. We become the system that accepts. Intelligence without ownership There is a difference between using a tool and depending on it for cognition. A calculator never made anyone worse at math. But it also never asked them to understand what it was doing. Modern AI tools sit in a different category. They don’t just compute. They interpret, summarize, explain, reason. Which means they don’t just extend intelligence. They can replace the experience of thinking. And once that replacement becomes comfortable, it becomes structural. The cloud problem, repeated at a cognitive level We have seen this pattern before. Cloud computing abstracted infrastructure:servers became services systems became APIs operations became dashboards complexity became someone else’s responsibilityIt worked brilliantly—until it didn’t. Because abstraction has a hidden cost: distance from reality. And with each layer of abstraction, fewer people understand what is actually happening underneath. Now we are doing the same thing with intelligence itself. From understanding systems to trusting outputs In earlier generations of engineering, you were forced to understand what you built. If a system slowed down, you needed to understand IOPS, memory pressure, CPU scheduling, network latency. Today, many engineers start at the top layer: Deployments, pipelines, managed services, black-box scaling. Even education has adapted. We teach how to use systems, not how they fundamentally behave. And that works—until something breaks outside the abstraction layer. Then the question becomes uncomfortable: Who still understands what is actually happening underneath? The real risk is not AI becoming too smart The real risk is humans becoming too comfortable. Because when AI works well, it removes friction. And friction is often where understanding is formed. If everything just works, there is no need to dig deeper. If nothing requires repair, there is no need to understand cause and effect. If answers are always available, the discipline of reasoning slowly erodes. Not dramatically. Not visibly. But cumulatively. “Just ask AI” is not a strategy There is a growing cultural reflex:Don’t know it? Ask AI. Need it explained? Ask AI. Need a decision? Ask AI.And most of the time, that is fine. Until it becomes the only mechanism. Because AI does not create accountability for truth. It produces plausible synthesis based on patterns. Which means it inherits one critical dependency: There must still be human intelligence capable of questioning it. Not superficially. But structurally. What happens when the underlying knowledge disappears? This is the uncomfortable edge of the argument. What if we gradually lose the ability to independently validate what AI produces? Not because we are incapable. But because we stopped practicing. Then we reach a point where:the system produces an answer nobody truly understands how it was derived and nobody can confidently say whether it is correctAnd at that point, intelligence is no longer something we use. It is something we receive. The paradox of progress We are building systems that make us more capable than ever before. And at the same time, potentially less resilient than ever before. Because resilience is not measured by output. It is measured by what remains when the system is not available. Or when the abstraction fails. Or when the data is missing. Or when the model is wrong. Closing thought AI is not the end of thinking. But it might become the end of careless thinking, if we are intentional. The real question is not whether AI can do the work. It is whether we are still willing to understand the work that is being done on our behalf. Because at some point, the dependency becomes invisible. And when that happens, the most important system we have is no longer artificial intelligence. It is human understanding. And if we outsource that too far, we may eventually discover that we still have answers— but no longer know how to question them.

Digital sovereignty is not where your cloud runs

Organizations often talk about digital sovereignty as if it is a geographical problem. As if moving workloads from one region to another, or choosing a “European cloud”, somehow resolves it by default. That framing is comfortable. It is also misleading. Because digital sovereignty is not defined by where your cloud runs. It is defined by what you depend on, who controls those dependencies, and how quickly that control can shift without you noticing. And in most modern architectures, those answers are far less reassuring than organizations assume. The illusion of location-based control One of the most persistent misunderstandings in cloud strategy is the idea that data residency equals sovereignty. If data is stored in a specific country or region, the thinking goes, it must be under that jurisdiction’s control. Therefore, the organization is sovereign. But sovereignty is not a storage property. It is an operational condition. Modern cloud environments separate storage, compute, identity, observability, orchestration, and security into distributed services. Even if data is physically stored within a defined region, the control plane often is not. Identity providers, logging systems, container orchestration, key management services, and telemetry pipelines may all cross borders by design. And each of those layers introduces external dependency. So what looks like sovereignty at the infrastructure layer can still be deep dependency at the control layer. The real dependency map is not obvious Most organizations can tell you where their workloads run. Far fewer can explain:Who controls their identity system Where authentication and authorization decisions are evaluated Which external APIs are critical to deployment pipelines How secrets are managed and rotated What happens if a major cloud control plane becomes unavailableThese are not edge cases. They are core architectural facts. Yet they are often treated as implementation details rather than strategic dependencies. The result is a mismatch between perceived autonomy and actual control. A system may look sovereign on a slide deck while being tightly coupled to a small number of global providers in practice. Sovereignty is not binary Another common mistake is treating digital sovereignty as a yes-or-no state. Either you are sovereign, or you are not. Reality is more nuanced. Sovereignty exists on a spectrum of control across multiple dimensions:Data sovereignty: Where data is stored and under which legal regimes it falls Operational sovereignty: Who can change, deploy, or interrupt systems Technical sovereignty: How replaceable core components are Economic sovereignty: How easily costs can be influenced externally Vendor sovereignty: How dependent you are on specific providers or ecosystemsAn organization can be strong in one dimension and weak in another. For example, you might host data locally while remaining fully dependent on a single global identity provider. Or you might have multi-cloud infrastructure but still rely on one provider’s proprietary orchestration layer. Calling this “sovereign” or “not sovereign” misses the point entirely. The real question is: where are you constrained without realizing it? Cloud convenience is a design trade-off Cloud platforms are powerful because they reduce complexity. Managed services remove the need to operate infrastructure at scale. APIs abstract away operational burden. Integrated tooling accelerates delivery. But every abstraction is also a dependency. When you adopt a managed database, you gain operational simplicity. You also accept a specific backup model, a specific failover mechanism, and a specific pricing structure. When you adopt a managed identity provider, you gain security and standardization. You also accept that authentication is no longer fully under your control. These are not flaws. They are trade-offs. The problem arises when organizations treat these trade-offs as reversible defaults rather than strategic commitments. The hidden concentration of control Over time, cloud adoption tends to concentrate control rather than distribute it. Even in multi-cloud environments, the same patterns emerge: One provider becomes the primary identity source One ecosystem dominates observability One pipeline tool becomes the standard deployment mechanism One set of APIs defines infrastructure behavior This is not accidental. It is the natural outcome of efficiency seeking. But concentration introduces fragility. Not necessarily technical fragility in the form of outages, but strategic fragility: reduced negotiating power, limited exit options, and increasing difficulty to redesign systems without significant disruption. The more optimized a system becomes around a single ecosystem, the less sovereign it tends to be. The uncomfortable question: what can you actually replace? A practical way to evaluate sovereignty is not to ask where systems run, but what would happen if key components disappeared. Not hypothetically in a disaster scenario, but structurally:If your identity provider changes terms or access, how fast can you switch? If your primary cloud provider increases costs significantly, what breaks first? If a critical managed service is discontinued, do you have an exit path or just a migration project? If external connectivity is restricted, which parts of your architecture stop functioning immediately?These questions are uncomfortable because they expose design assumptions that are usually left unchallenged. Most organizations discover that their “sovereign” architecture contains far fewer independent components than expected. Sovereignty requires intentional friction True digital sovereignty is not achieved by avoiding cloud platforms. It is achieved by designing for optionality, even when it introduces friction. That can include:Avoiding unnecessary proprietary abstractions in core systems Designing data portability as a requirement, not a future task Separating identity from infrastructure providers Maintaining documented, tested exit strategies for critical services Ensuring that no single provider becomes a structural bottleneckNone of these decisions are purely technical. They are architectural governance choices. And they often conflict with short-term efficiency goals. Which is why they are frequently postponed. Leadership, not infrastructure, defines sovereignty At its core, digital sovereignty is not a cloud architecture problem. It is a leadership problem. Because the hardest part is not building systems that are portable or independent. The hardest part is deciding when dependency is acceptable and when it is not. Every organization will rely on external platforms. The question is not whether dependency exists, but whether it is understood, measured, and intentionally managed. Without that clarity, sovereignty becomes a narrative rather than a capability. Closing thought Digital sovereignty is not where your cloud runs. It is whether you could still operate if your assumptions about that cloud stopped being true. And in most modern architectures, that question is less theoretical than it seems.

The future of managed services is letting go of control

For decades, managed services have been built around a simple idea: The provider builds. The customer consumes. We standardized desktops. We standardized servers. We standardized networks. We defined what users were allowed to do, locked everything else down, and called it governance. It made perfect sense. Technology was complex. Expertise was scarce. Standardization created stability. But if I look at the direction our industry has taken over the past fifteen years, I don't see a story about better infrastructure. I see a story about increasing autonomy. And I don't think we've fully realized what that means for the future of managed services. This didn't start with AI AI is getting all the attention. But the shift started long before large language models. Think about what we've introduced over the last decade. Infrastructure as Code allowed engineers to describe infrastructure instead of manually configuring it. Cloud platforms removed the need to provision hardware. The modern workplace allowed users to work from anywhere, on almost any device. Power Platform enabled business users to automate processes without waiting for IT. Platform engineering is giving development teams self-service platforms instead of ticket queues. These aren't isolated innovations. They all move in exactly the same direction. Every generation of technology removes another dependency on central IT. Every generation gives more capability directly to the people creating value. AI simply accelerates that trend. Customers don't want fewer capabilities They want fewer dependencies. That's an important difference. Organizations don't want to submit tickets to deploy an application. They want to deploy it themselves. They don't want to wait three weeks for an environment. They want it in three minutes. They don't want IT departments approving every workflow. They want to automate their own. For years, many managed service providers viewed this as a threat. I think it's exactly the opposite. Because customers aren't trying to eliminate the MSP. They're trying to eliminate unnecessary friction. The MSP is no longer the builder Imagine a product team in three years. A product owner describes a new customer portal. An AI engineering team generates the application. Another agent provisions infrastructure. Security agents validate policies. Test agents perform functional and performance testing. Deployment agents roll everything into production. None of that feels unrealistic anymore. The interesting question isn't whether this will happen. It's what role the MSP still plays. I don't believe the answer is "building the platform." Because increasingly, customers will do that themselves. Or rather, their AI agents will. The foundation becomes the product If customers can build, deploy and operate faster than ever before, then the value of the MSP shifts underneath the visible work. The platform becomes the product. Not the portal. Not the virtual machine. Not the Kubernetes cluster. The invisible foundation beneath all of it. The landing zones. Identity. Networking. Compliance. Policies. Guardrails. Observability. Knowledge. Recovery. Customers won't ask an MSP to deploy an application. They'll expect an environment where deploying applications is safe by default. That's a fundamentally different business. Governance stops saying "no" Many organizations still think governance means restricting users. Removing permissions. Blocking installations. Limiting change. That approach worked when IT was responsible for every change. It breaks down completely when hundreds of developers, business users and AI agents are continuously creating new workloads. The answer cannot be to review every deployment. It cannot be to manually approve every prompt. And it certainly cannot be to lock everything down. Governance has to evolve from permission to policy. Instead of deciding who may build, we decide the conditions under which anything may be built. Instead of reviewing every change, we continuously validate every outcome. Instead of configuring environments manually, we enforce compliance automatically. Control doesn't disappear. It simply moves to a different layer. The MSP becomes an enabler of autonomy This may be the biggest mindset shift our industry has ever faced. For years, success was measured by how much work the provider performed. Tomorrow, success may be measured by how little intervention is required. The best managed service providers won't be the ones operating every workload. They'll be the ones enabling thousands of safe deployments that never required them in the first place. Their customers will move faster. Developers will have more freedom. Business teams will automate more processes. AI agents will continuously improve solutions. And underneath all of it, the MSP quietly ensures that security, compliance and operational resilience remain intact. Invisible when everything works. Essential when it doesn't. Expertise doesn't disappear Some people interpret AI as the end of expertise. History suggests otherwise. Every abstraction has increased demand for people who understand the layer beneath it. Cloud didn't eliminate infrastructure expertise. Infrastructure as Code didn't eliminate architects. Platform engineering didn't eliminate operations. It simply changed where expertise creates value. AI will do exactly the same. The future MSP won't spend its days deploying resources. It will design the ecosystems in which autonomous systems can safely deploy themselves. Closing thought I don't believe the future of managed services is about doing more work for customers. I think it's about making customers capable of doing more themselves. Not because the MSP becomes less relevant. But because relevance is moving. From operating technology... ...to enabling autonomy. The organizations that understand this will stop asking how AI fits into managed services. They'll realize managed services are being redefined by the same force that is reshaping every other part of IT: giving more control to the people closest to the problem, while ensuring the platform beneath them remains secure, compliant and resilient. That, to me, is what the next generation of managed services looks like.