True North podcast #6 with Stijn Christiaens (co-founder Collibra)

Well, happy to be here, Bert. Thanks for having me over and thanks for all the nice words. The respect goes both ways because you've done great things as well. And thanks for reminding me of how long it's been.

Yes, we have been in the same school at the same time. Let's not talk about when that was. And we do come from the same part of small Belgium coincidentally. So let's see if we can mix that in the conversation somehow. Happy to be here.

Yes. Yes. And quite frankly, Bert, I'm really happy to see that on the data topic there are a number of startups and founders and companies in Belgium really making a mark on the landscape worldwide. So, let's do some more of that, please.

No. And I don't know if that is necessarily necessary that everyone is known across the whole world. It depends on where you want to be known, where your market is. But I agree, Bert, that part of being a Belgian carries some level of modesty almost. I don't know how to put it, especially when you compare it to the style that maybe American founders have. One thing I want to add: you mentioned the word competition. In the beginning days of Collibra, I looked at that word in the same way, but over time I've come to learn, as you know, we have had it happen to us but also maybe we've done that to our broader ecosystem. When you're in the technology landscape, my viewpoint on competition is now slightly different. I see a technology startup, scale-up company, the whole industry almost as an ever-evolving game of competition. One day your friends, the next day you're enemies competing for the same budget, but really it's all about moving terrain and moving together. Even if you look at the larger players, that same game holds true. Like Microsoft, for example, they say, 'Oh, we're friends with OpenAI because it gives them an advantage,' and a year later, two years later, 'Well, maybe we're not such good friends anymore.' So, it's that ever-evolving game of competition rather than pure competition sometimes.

Well, we can talk about it for quite a while, so I'll just give you some points and we can discuss. But essentially, you could almost say we can look at strategy in a number of ways. And one dimension is the one we're discussing now: are you going to be a category-creating company or are you going to be a category-following company? And again, this is just one dimension of your strategy. But with Collibra, we've chosen to be a category-creating company, whereas we could have also chosen to be a category-following company. Except in our space, the category for data governance software did not exist yet, because people looked at governance as a people and process problem, and they're right, but at scale, a people and process problem takes technology. Just like CRM, you could argue, is also a people and process problem, but at scale it requires technology. So that was our play. But just to give you the counter example, a category-following company is also a good strategy. It's just what do you choose and what is available for you in your market. Essentially, take for example like an Instagram. If Instagram or social photo sharing had not existed yet, then Instagram would be category-creating. If it already exists, well then you're going to create a copycat or something that leapfrogs that existing already known space. So people know what they're looking for. They know the features, the capabilities, the names, the players. And then you're just offering a better, faster, cheaper widget. Whereas if you do category-creating, and that's what we did, and what it takes... I mean, it's been 17 years since we started the company and we're still working at it. So our moving target of the category is still in play. But what it takes is a number of things, but for sure effort. It takes a lot of effort to be the leader in creating a new category. It takes an ecosystem as well, because typically you don't create a category on your own. You do that together with customers, obviously, but also with other players in the market, partners which are technology partners or consulting partners, but you also do that together with analysts, for example, and a whole bunch of other stakeholders in a broader ecosystem. You do that with resources. Creating a category takes time and effort. So you don't do that overnight. You have to apply yourself probably for a decade, maybe in our case longer.

And like I said, Bert, we can unpack each of those components. But what it also takes is, like all leadership, it takes wanting to set the standard. I imagine leadership as you're walking around in the dark in a dark forest and you're there with a group of people. Then you're like, 'Well, which direction are we going to go?' Nobody knows, but you have to choose. So somebody has to be willing to go first and go out in the dark. Maybe the first path you choose is the wrong one and you have to double back and try another one. So creating a category takes that leadership to say, 'Okay, what are the features for this market?' And we don't know always, but let's choose this set. And some of that set will be experiments that succeed, some will be experiments that fail. And if you're not ready to make those experiments, place those bets, and learn from those experiments, then you're not ready to be a category creator because you are hitting a moving target. And we've been doing that for 17 years. So for example, now, Bert, why it's not over? Well, AI came to the market. So all of a sudden, there's new compliance requirements, which means that our category-creating strategy is not done yet. We have to keep moving the needle.

Funding is an important part of it, whether the funding comes from your business or external capital doesn't matter. You have to come up with the financial asset that helps you, to your point, survive long enough. And I think you were the one who originally introduced me to the Wardley maps, Bert, so thank you very much. And to all the entrepreneurs in the audience, go study Wardley maps because it is a really useful instrument for timing your market, which is essential. So Bert, for example, when we started with our original position, it took us a good six years of chugging through mud, and then there were events happening in the market that allowed us to pick up that acceleration. But if we had moved faster in those first years, maybe we wouldn't have made it. So the period of six years moving through the mud was also necessary for the strategy to work out. That's why we raised enough money out of the gate, like at seed. It's the only moment you can do a bluff kind of moment. And spend it wisely, knowing it would take longer than we expected. Not overhiring, very cautiously designing your product-market fit, and only when you have enough evidence would we step on the gas and let it fire. But we spent our money wisely knowing this fact.

Yes.

I don't know if it was me, but it could have been. It wouldn't surprise me, though.

I mean, even on today's AI wave, we're about 3 years into that platform disruption. So these are waves that others make, we just have to ride them somehow. But even there, you can see how we're still very early on that AI. If you read the news and follow the social media feeds, it seems like AI is already here and we're being overtaken by agents, but in practice, even that AI widget moves through that cycle in the same way.

No, you're not wrong. But I'll give you my viewpoint. And again, it's 17 years in this governance market, so you become a governance conehead over time. But it goes even further. So we created this category. We were fortunate to have that opportunity to do so, and again, still working at it. But what we saw was that the word itself, governance, because of its origins in the industry, was associated with regulation and compliance. That's why the first big banks had to really have a chief data officer and had to take on governance and quality and all that stuff. And what happened is that governance got a pejorative connotation in the market. People looked at it as the data police or the ones saying, 'Oh no, you cannot data,' because the original data strategies were very much defensively focused. Now that's evolved over time. That doesn't mean all companies have evolved equally. Some have to go to those time zones still. But essentially, what we then did at Collibra, we said, 'Let's tone down the governance word a little bit,' because even if our features or widgets are perfect, which they never are, the governance word itself carried that negative connotation in the market. So we toned it down a little bit, tried some different words. But indeed, to your point, Bert, especially with the coming of AI but also a number of other reasons, we said now it's time to double down actually on that word. So earlier this year, we said, 'Let's come out with a bigger vision for Collibra that it's about unified governance, data and AI governance together,' because indeed we're seeing it all across the market how AI is actually resurfaced that governance. Now it's accelerating at a stand in a way. Like AI only makes your problem with data bigger, so you have to have governance in place else everything will go wrong.

Yeah.

So you'll see a lag effect. Now I agree with you. People who know what to do know they have to put governance up front and they know they have to take care of their data if they want to have good AI. But a lot of business people don't make that connection. They look at AI, 'Well, it's just a chat in the cloud. Why do I need to invest in my data?'

Well, we studied that a little bit. We had the benefit of Gartner researching that role as well. So actually, Gartner has a framework where next year they will go to version six of the chief data officer. So version one was defensive, version two offensive, version three was about digital transformation, version four is about data products, they have a version five which is about the CDO as an entrepreneur, and version six next year is likely going to be about process, because data and AI are changing process, so obviously the CDO has to play a role there. But if you look at their studies, you will find that in 2002 or something like that, there was one chief data officer worldwide. I believe that was at Capital One of sorts. And then indeed, there were about 10 or 20 of them around 2010 or 2012, and these would have been the globally systematically important banks, the biggest banks who were trying to get ahead of the regulation that was coming. Now there's probably over 100 or 200,000 bosses of data worldwide.

Well, it's hard to measure that. We'd have to make a proper Wardley map to educatedly guess it in some stage. But I wouldn't say it's mature yet. I would say it's maturing. I would say it's in the stage where, if you would look at it as a human being going to school, maybe it's in college or university about to go into work and grow up independently. And I put its maturity 3 years from now, over this period, 5 years, 7 years. It's hard to measure, but I hope in the 2020s, the roaring 20s of data, I hope by 2030 governance is business as usual for most large organizations. I only see a part of the industry, but today, for example, when I walk into manufacturing companies who are sometimes slower to adopt, and I go to the operational sites and you start talking about data stewards, some people never heard about data steward. So there's still work to be done on the evangelization and adoption. So that's why I was estimating indeed it's maturing but not fully mature yet. There are still companies who don't have data stewards at all. Maybe on the IT side, business side, but some functions do not have it yet.

No, no. And you know, we were having a conversation about this earlier with another team, and this is broader than just governance. So I'm just going to make it about the data asset, which you're touching from an angle, we're from an angle. But if you look at it, Bert, in organizations, including in manufacturing, their organization is about taking an asset or a combination of assets and putting their magic on it and then producing value from that. So organizations have mastered doing that with the money asset, with people assets, talent, with IT assets like computers and laptops, with materials and sub-materials and products. So each of those is an asset. But most of those assets, they have multiple decades of maturing into that, or some even 100 years or more. Whereas the data asset, I mean, companies have invested in data since before the mainframe, but they've never invested in data as the asset itself. It was always just, 'Oh, we're going to invest in storage for our data or like tapes or the data warehouse.' But really having organization around it in terms of process and responsibility coming through a role like a steward or a data ninja, call it whatever you want, that's a younger discipline that is maybe one or two decades old that is becoming into the market. So in that sense, what you're saying doesn't surprise me that people on the floor have not heard about being a data steward. So my opinion there is it's not about governance, it's not about quality, but it's about broader the data asset, and that is still so much growing up or education and awareness that needs to happen in its broader sense on the data asset, which is all about what do you do with it and how do you care for it. So a lot of that education will come over the next decade for sure.

Well, it's a moving target in the market, but one that is now being pushed hard in the market because we're all confronted with this AI experiment that's an issue on the world. The genius is out of the bottle. But if you go back, AI governance is not a new topic. It's just that before GPT came to market, only some PhDs in physics with 10 years experience in data science and the right technology and organization behind them could put AI in production. So let's say this is 5 million people who could do that, and 80% of them failed. So this would have been the AI governance need. So people talk then about model governance, for example, and in banks you will find risk calculation around AI, like for example credit scoring, there would have been controls there. But what happened when GPT came to market? You go from 5 million people roughly who could put AI in production to 5 billion people, anybody who could speak English as a matter of speaking. So all of a sudden, that topic of AI governance overnight became a lot more important for a lot more organizations. What it is about, and I'm going to try and explain it in my own words, so I don't have a crystallized definition, but it's really about if we look at AI, we too much look at it as anthropomorphizing these days. Like, 'Oh, I asked the AI or the agent did this, and it should be fine, and if it's wrong, it's the robot's fault.' That doesn't work. We cannot anthropomorphize that accountability. We are still as an individual responsible, or our organization, and typically both. So it's the operator or the manufacturer of a machine, call that machine an agent or an automated system, it doesn't matter, but the operator or manufacturer is responsible for what they put in production. And I think that's what AI governance is about. Which starts by making considerations like, 'Oh, we're going to put some AI in production. What is the use case? What is this AI going to do? And are we as an organization okay with that use case?' Because you can say, for example, 'Well, we're going to do sentiment analysis using AI.' Is our organization, our internal policies, ethics, are we okay with this? And then it goes all the way through to the whole life cycle of AI and having controls in place, which includes some regular data governance checks like who's responsible for the data that goes into the AI, which includes quality checks because AI with better quality data is a better AI model supposedly. But then it also goes into, now this AI runs in production, how do we know that it's functioning within certain boundaries that we're willing to accept? So all of that is end-to-end governance going from the creation of it before a letter of code is even written to something's running, let's check whether what's running is okay with what we as an organization want to accept. So in its broadest sense, that's what AI governance is about. It's about doing AI the right way, just like data governance is doing data the right way. Now what's interesting about this phenomenon, Bert, is we see echoes of data governance in the early days. When data governance started to come up as a discipline, you saw confusion in the market. The first CDOs were like, 'What are you doing? How are you going to do it? Why are you going to do it? How are you going to measure whether you're doing it the right way or whether you're making progress?' So there was this uncertainty for this new discipline. And the organization was just answering based on a regulatory need. So they were figuring it out in the Wardley map early, in the incubator phase. People were just, 'Well, we got to do something. Let's do it. Let's figure it out.' So they were signing CDOs by line of business, by domain, figuring all sorts of things out. And what I see now that's come more into maturity, but what I see with AI governance is that this uncertainty is resurfacing. Like, 'When are we going to do AI governance? What for?' I was having a conversation with one customer. There were 10 people in the room, same customer, same company. And I asked, 'Who's doing AI governance?' And one of them raised his hand and said, 'We're going to do it, but it's next year.' Same company, same meeting, the other person raised, 'Yeah, we're doing it now.' This leads me to believe that AI governance is increasing that moving target of our category-creating strategy. There is overlap with data governance because AI needs data, but there is also new wide space. For example, in data governance you would never talk about agents. In AI governance, you need to work on an agent repository, for example. So there is overlap, but there is also new requirements that are still unfolding as this underlying technology is rapidly evolving still.

Yes, of course I do. Because in our market, there is a lot of regulatory drivers, which I think is a good thing because if you let companies do whatever they want without regulatory constraints in place, then there is going to be use of data and privacy will be violated and a whole bunch of other things. But if you're only doing it regulatory wise, it's not good enough. You need to add a value, an offensive data strategy, to really convince your business that this is business as usual. I'll give you an example, Bert, that we saw ourselves happening with privacy. So you know about the big daddy of privacy regulations, GDPR. Since then, we've identified worldwide over 200 privacy regulations. But what happened is privacy was seen as, 'We need to comply to GDPR.' Everybody and their dog, including all the people listening, and just two of us, we've all checked the boxes when we visit the website. Check the box for 'Yes, I want to allow cookies' or stuff like that. So a lot of initiatives in organizations, although GDPR is principle-based and really wants to go to the heart like do good data practices, if you use data make sure there's an assessment, whatever, a lot of the initiatives just cover their basis. So it's almost like, 'Ah, we got to do this for GDPR reasons. Let's check the minimum we need to do to comply.'

It's over. And often time find that those initiatives, although the organization has tried, they have this superficial activity in place now which is not necessarily touching the actual data operations. So on paper they might look like they're complying, but in practice they're not complying. But that will be uncovered over the next that will come with but good to create urgency and good to create budget, so use it if it's there, but you need to find value-add cases as well.

Yeah. So I fully agree there. You know, I don't want to step into that lives on the risk topic for a second, but if you look at the regulatory angle and combine it with the AI governance topic, you can see that at this time the regulatory angle has some weakness to it. For example, what's happening in the EU with the EU AI Act, they're delaying that in time. They're softening it up a little bit, maybe to give organizations more time to act. If you look at the US, it's an administration which is not very conducive to more regulation rather than less. Or the other way around, you will see that they have a different kind of shift or bias or priority on regulation because all administrations want regulation. Maybe this one is more about cyber security and being competitive, but they still apply regulation.