As Indian enterprises move from experimenting with AI to deploying it at scale, the focus is shifting to building the foundations needed for sustained adoption. Sandip Patel, managing director, IBM India & South Asia, says the next phase will be driven by agentic AI embedded in core business processes, but scaling it will require stronger data foundations, greater control over technology and new skills. In an interview with Sudhir Chowdhary, Patel discusses digital sovereignty, open-source security risks and the challenges of building secure, resilient AI environments. Excerpts:
Where is the biggest gap between India’s AI ambitions and its ability to govern, secure and control the technology? What will determine which organisations scale AI successfully?
The biggest gaps today are in governance, data quality, infrastructure and skills. A recent IBM India AI study shows that gaps in AI governance (68%), uneven data quality (57%), and lack of accessible, affordable and secure cloud infrastructure (77%) are major barriers to AI readiness and scale. Only about 30% of employees possess the level of AI literacy needed.
As organisations deploy autonomous and agentic AI across core business processes, they will need clear accountability, stronger data foundations, security by design and visibility across the AI lifecycle. This becomes particularly important as enterprises work with multiple models, applications and technology environments. Equipping employees to work effectively with AI and exercise judgement where it matters most will be equally essential.
Another key factor in deploying AI at scale is an organisation’s ability to maintain control over its data, technology and operations while ensuring digital sovereignty.
Digital sovereignty is becoming increasingly important as enterprises build AI-driven businesses. What does it really mean for Indian enterprises, and why does it matter now?
Digital sovereignty is becoming increasingly important as AI, data and critical digital infrastructure become central to how enterprises operate and compete. For Indian enterprises, it is not about isolating technology or limiting choice. It is about having greater control over four interconnected dimensions: data, operations, technology and AI sovereignty.
The control needs to extend across the infrastructure and software platforms that support data and AI, while allowing organisations to retain the flexibility to innovate and scale. Open technologies and interfaces, hardware and model neutral AI services, interoperability and end-to-end automation can help enterprises maintain this control without compromising innovation.
This balance is particularly important now, as Indian organisations look to build AI driven businesses at scale while navigating evolving regulatory, security and technology requirements.
How can enterprises balance sovereignty and governance with innovation in open technology environments? What is IBM doing to help them achieve this?
We offer open, trusted and secure technologies that help enterprises manage AI risks, security and governance while scaling digital environments. Our approach to sovereignty is two tiered. The first addresses data residency, for which we have partnered with an Indian telecom provider to offer IBM’s cloud and AI services to help Indian organisations, especially in the regulated sector, meet compliance requirements. Second, through IBM Sovereign Core, we enable operational, technology and AI sovereignty. In collaboration with Sarvam, we are helping enterprises operationalise sovereign AI aligned with India’s governance and regulatory requirements.
Many Indian businesses rely on open-source applications and software. Does this make cybersecurity and governance more challenging, and where are the biggest risks?
The challenge is not open source itself, but the complexity of securing and governing the software supply chain around it. While AI is increasing the speed at which vulnerabilities are discovered and exploited, remediation measures have been slow. In an AI-driven threat environment, a longer remediation cycle is a business resilience issue that needs immediate attention and solutions.
Enterprises do not need to address every vulnerability with the same level of urgency but focus on the ones that pose the greatest business risk. So our approach is three layered – provide the fix; prioritise the remediation for those vulnerabilities and orchestrate the execution.
What is Lightwell, and how does it help enterprises address these challenges?
Lightwell brings IBM and Red Hat’s engineering scale to offer trusted remediation approach for the open-source software supply chain. Through a global force of more than 20,000 engineers supporting AI-assisted triage, validation and backporting, Lightwell provides artifacts for the open-source package versions for enterprises to run in production, strengthening their security and resilience.
Lightwell’s value lies in reducing the time, uncertainty and operational risk between vulnerability discovery, prioritisation, trusted remediation and safe production deployment. When combined with IBM Concert’s risk-based vulnerability prioritisation, enterprises can focus on the most critical risks and accelerate remediation with greater confidence. The broader objective is to make open-source software more secure and resilient without slowing innovation, giving enterprises greater confidence to adopt open technologies.