Zurich US chief data officer recognizes that AI isn't the answer to every problem

When you're the chief data officer at an insurance company that's more than 150 years old and primarily serves businesses, you have to figure out how to make AI work while dealing with legacy systems that can be expensive to change. For CDO Kristen Bessette, it also means understanding that the basics still matter, especially in the age of AI.

At an insurance company, you need to consider governance, security and privacy. You have to figure out which systems to modernize, which data to get ready for AI applications and even when AI is most appropriate.

As she says, it's not the answer to every problem, and it's best to recognize that from the get-go. "I told my team when I came in, listen we don't need a sledgehammer to kill a fly. Sometimes you just swat it, right? So if it's a swatable solution, just swat it," Bessette told FastForward.

She means that there are often cheaper solutions. You need to understand the problem and apply the right solution to it. Sometimes that's AI, but not all the time. "If you need an RPA or a rules engine, just build that. It solves a problem. It's way cheaper. We're good to go," she said.

I spoke to her about the challenges she faces trying to modernize where it matters, while balancing safety, security and cost.

It's all about that data, that data

Like most companies, it always starts with the quality of the data. The cleaner your data, the better it is for building AI applications. The trouble is that when you're a 150-year-old company, chances are you have data sitting in a lot of different forms, across a lot of different systems. As the data leader, Bessette needs to pick and choose which data repositories are worth modernizing and which ones to leave in place.

"To have the AI you have to have the right data foundation, and a lot of that is having good technology that enables it. So some of it's a technology play, some of it's a curation play. How do you get all that data ready for the AI?" Bessette said.

The good news for Bessette is that she wasn't starting from scratch. Zurich Insurance had already begun modernizing its data platforms before she arrived, initially to support more traditional analytics and handle growing volumes of data. "We had a good start. I didn't come in and build that. There were a lot of people building that already," she said. Now her team is building on that earlier work while figuring out what needs to change to accommodate AI.

Sharing responsibility across departments

Bessette is not working in a vacuum, she has to work with other departments and executives to make sure that AI is rolled out in a responsible manner, taking into consideration all the needs of a company like this. "For all our solutions, we have a one joint AI intake process. So any solution from anywhere in the U.S. comes in through our one intake process that we sit and look at across the business unit together," she said.

Even though she rolled out Copilot to 10,500 U.S. employees, she says there's a big difference between an employee using Copilot  to summarize emails and deploying an external-facing AI application that thousands of people might use without human oversight.

"Let's assess the risk of it, and then we'll apply the appropriate level of governance because I want everybody to use AI. I want them to go out and build their own solutions," she said. The trick is doing that without exposing the company to any unnecessary risk.

That means when it comes to building agents and governing them, individual departments have their own goals around safety, effectiveness, who the agents are deployed to and so forth. But those goals also have to fit within a broader company-wide framework to ensure agents are operating in a safe way.

This requires regular communication with the CISO, the compliance team and other key parties to make sure there is a strong governance framework in place that takes into consideration the needs of the entire company. "We look at tooling jointly with the CISO to make sure that if we want to bring in something to monitor agents, for example, that it covers many use cases. So that we can kind of share some of those platforms and use them across to do the things we want to do together."

For Bessette, the goal is to give employees room to experiment with AI while understanding and managing the risks. That means keeping the focus on data quality, governance and security, the same fundamentals that mattered long before generative AI came along.