The Enterprise Alchemists
The Enterprise Alchemists is a new podcast for Enterprise Architects to have honest and in-depth conversations about what is relevant to our world. Expert guests provide additional context on the topics of the day in Enterprise IT.
Your hosts, Guy Murphy and Dominic Wellington, are Enterprise Architects at SnapLogic, with more decades of experience between them than they care to admit to, and the stories that go with it.
The Enterprise Alchemists
The Crossover Episode: Architecting for AI in highly-regulated enterprises
Pressure to “do something with AI” is loud, but the stakes are higher when patient data, regulators, and legacy systems meet non‑deterministic models. We sat down with the hosts of the Enterprise Architecture Experience podcast — Hassan Abba from AstraZeneca and Jon Hill from Alvotech — to compare how a global R&D giant and a thousand‑person biopharma scale-up are making AI useful without trading away trust. The conversation gets practical fast: where AI speeds discovery, where it should never touch regulated data, and how to draw clean lines that everyone can work with.
Hi, and welcome back to the Enterprise Alchemists. This is Dominic from SnapLogic, and joined by my co-host, Guy. Hey Guy, how are you?
Guy:I'm good as ever.
Dominic:Fantastic. And we are joined this week by two very special guests. Uh so we heard that someone else was doing a podcast about enterprise architecture. And initially we thought, oh no, now we have to arrange a fake accident or something. But then we thought better of it and decided that we should actually do a crossover. We should have them on our show, and maybe later on we'll go in their show and we can have a sort of enterprise architecture super group going on here. So without further ado, Jon, Hassan, thank you very much for agreeing to join us. Would you like to introduce yourselves and explain a little bit less facetiously what we're all here to talk about?
Hassan:Okay, well, firstly, Dominic and Guy, thank you for having us on your podcast. Brief introduction. So, my name is Hassan Abba. I'm the head of R&D IT architecture at AstraZeneca. I have a team of approximately 35 IT strategists, enterprise architects, and solution architects that work in my team.
Jon:Yeah, and hi guys, my name's Jon Hill. So I am the director of enterprise architecture at Alvatech, who are an Icelandic biopharma company. I've been there for three and a half years. I'm the only architect in the whole company, so kind of the opposite end of scale to Hassan. Although the reason Hassan and I know each other is because I used to work at AstraZeneca and headed up the big architecture team there. So yeah, that's me.
Dominic:And of course the two of you host the Enterprise Architecture Experience podcast, and we will drop a link to the show notes in there so that you can go and listen to their podcast as soon as you finished listening to this one, of course. But thank you both so much for for joining us. I listened to a couple of the episodes of your show, and I was very interested in the topics, and they're obviously right up our street. So I'm hoping this will be a valuable conversation for our listeners. So, Guy, do you want to kick us off? There was a question that you wanted to ask Hassan and John.
Guy:Yeah, absolutely. And especially with you both being in the industry that you are, but with two different scales of size. One of the big hot topics I'm seeing with a lot of enterprise architects that I'm working with is obviously AI is this sort of the new kid on the block, and also is a highlight of a lot of executives. But I'm seeing a lot of questions about not is AI valid anymore, but actually how do you fit it into a more traditional enterprise landscape of systems? And I'll be a little bit more specific on this because obviously, every pharmacy has very technically advanced research environments to do what they do. Obviously, with COVID, AstraZeneca became a global brand around this topic, but I think one of the exam questions is when you start getting into sales and manufacturing and customer care, and even the mundane systems like HR, how do enterprise architects need to think about bringing in these non-deterministic systems into what are pretty proven and stayed processes and capabilities in the organization? So, yeah, I'm really looking forward to getting your point of view on this. How does the new meet the old?
Jon:Yeah, so one of the things we do in AlvaTech is we try and stay away from customization, you know, we're a mid-sized company, just over a thousand people, and so you know, at the moment we're not at the point where we're building our own AI, but what we are seeing is obviously more and more vendors are putting AI into their applications, and it's kind of like you know, a few years ago it was all about BI and analytics, and everybody was putting their own BI and analytics functions in there, and at the time it was about evaluating is this something that we want to take on, is this something that we want to use, is it gonna add business value? And we do the same with AI, to be honest. Every time that we see an AI feature, a gen AI driven feature in these products, we will go and evaluate it, make sure that it's not doing anything bad with our data and so on. Uh, the difference between I think AI and the the BI use cases is that AI has this extra element of taking your data, storing it off-site, you know, the ability for companies to do other things with it. So there's that slightly more kind of security aspect to it. But but for me, it's about having that ongoing conversation with the business. Um, and then and then obviously the other thing we've got is is a growing pipeline of people asking questions can I use AI to do this? And that's about a kind of a prioritization effort working through and seeing is this something we can afford to invest in, trying to understand what the value case for those things is, and treat each one of them separately and in their own right. And the final thing I'll add is one of the things we did very early on is establish a Gen AI policy that said how we were going to do this. We we immediately blocked certain applications, asked people not to use those, but made it very clear what people could use, , and just establish that very early on so that people were as aware as possible. Um, because as you say, that non-deterministic aspect can be sometimes quite dangerous, especially in a regulated environment like pharmaceuticals. But I know Hassan, obviously, you're coming from a bigger company, maybe you want to describe what you guys did.
Hassan:If I think of AI, it's it's it's a br it it can be applied across a broad landscape. Now, if I think of RD as well, John, as you said, it can be a regulated landscape. But there's two parts to research and development. There's the research part, which is non-regulated. In that part, it's a free-for-all. You can put models, you can develop models, you can do what you want because you want to innovate in that space. But as soon as you get into the development spy space, you get into clinical trials and regulation regulatory affairs and so on, that becomes a regulated part of RD, and you're dealing with patient data, and you need to make sure you're dealing with biases and so on and so forth. So, that end of the spectr , you need to be a bit more deterministic. Okay, so let's let's talk about the research end. But before I get into that, let me just kind of give a brief sense of when we're talking of AI, what are we talking about in very layman terms? Okay, if I think of the early part of AI, which was symbolic AI, and that's when you were building expert, what we call expert systems, okay? That was up to the up to about 1980, the the trend was expert systems. Get to a knowledge worker or an expert, a doctor, or whatever is an expert in a certain area, and look at what kind of work they do and what is their thinking process and codify that into if-else statements. And that program is an expert system that, if you can talk to it, if you've got enough knowledge from a knowledge worker, you've computerized that knowledge. If you look at where we are today in the sort of 2010 onwards with machine learning growth and deep learning growth, it flipped that concept on the other way. It basically said, don't worry about the expert, look at the data that is coming out of the expert, whatever that data is, think of cat pictures or any kind of data that you're dealing with, or driving down a road and the data that a car will collect by just driving down the road. If you can collect that data and make the program create the if-else statements that I was talking about, now you have a model. Once you have that model, then you can use that to be the expert system. So, in essence, you're using the data to create the model or the if-else statements. Okay, so the point is that now what I'm saying is that the AI system is only as good as the data you've given it or programmed it with to create that model. If you're going to give it biased and fluff data, then of course it output is going to be biased and fluff. Okay, that's just the nature of the game. However, there are scenarios where that world view that you need to put into a model is sometimes not needed. Okay? Think about it this way. For example, if I'm doing molecular simulations or gravity simulations, a ball falling down, okay? If I can measure that, then in essence, what my AI system will be doing is will be it will be creating Newton's laws of motion, but incorporating air resistance and everything else in there without having the need for very complicated computation or physics laws, deterministic laws, right? The data is managing that for you. So, in that sense, we can use that power in research. Does that make sense?
Guy:Yeah, I think I think so. It's it it's an interesting premise to describe it, but I I guess but one of the output, and that definitely makes a lot of sense when we're looking at you know concepts like deep learning AI, and by the way, I completely agree with your statement. Um, is one of my personal beefs, which is we've hit we've we've reached the peak of AI is magic in the sense of no one actually steps back and says there's a whole suite of different technologies under AI nowadays, , not just the the the the the current core kids on the block like chat GDP. Um so to complete that, I guess one of the questions, and again, this is because of the interesting and sort of Gartner says it's hit the peak. I think we could all discuss that in depth on another podcast alone. Um but the LLMs are are are acting quite differently in that space. So I guess one of the questions I have for you, Hassan, is are you using LLMs inside of your research or are you more using deep learning? Uh like I'm not gonna say traditional, but the other modes of AI analysis within your frameworks.
Hassan:Okay, we're using all sorts, right? So, for example, if I think of research, we've been using deep learning. Okay, but having said that, think about the DNA. The DNA is a string of characters, okay? Uh you've seen A, G, C, T, and so on. It's a string of characters. By nature, you can put those strings of characters into an LLM. So just recently I was looking at a published paper. Uh I can't remember which university have come out with it, but they've come up with something called Nature LM. Okay? How can they put strings of protein codes, genomic codes, etc., into foundational language model to create a model that is very scientific focused. Okay? Likewise, think of chemical structures. Chemical structures can be described as strings as well, right? Think of the C, H, four, and so on that will make up a chemical structure. So if you can put that kind of information into a large language model or into an AI model, then you can do predictive work with it. Alpha Fall is an example of that, right? It won the Nobel Peace Prize for that. It took 200,000 existing protein structures and then it predicted what un unsolved protein structures would fold into. So these these challenges are are there and they've been scientifically proven that they work, and we can do use these as tools to help us understand nature.
Jon:I guess I guess one of the important things on on that side is is that in the farmer industry we tend to, and I think this is the the same across other industries as well, is we're absolutely using these things as advisors rather than truth tellers, and that's where it changes a bit. I guess from the the average person using Copilot or Gemini in a browser to say, , tell me, you know, give me a potted history of Roman history. Um, the difference between that and us saying, you know, how might you move from molecule X to molecule Y, then the next step of that is to go and actually test that in a lab and go and make that up and make sure you can get from molecule X to molecule Y. So that the AI is merely helping the process along rather than coming up with the ultimate answers. So even though it's an ungoverned area, it's providing that assistance for for the scientists to do their job and supporting those scientists in actually narrowing down what they would have done before. So where they might have done a hundred experiments and come out with four pathways that that were viable. Now they do six experiments where four pathways are viable because it was predicted that way that the four would be the most viable.
Hassan:Exactly. And I think John, in that six experiments, I'm okay with one of those experiments being a hallucination.
Dominic:That's because you're looking for it to be creative, that's you're looking for an unexpected result. So I was going to say you've got that advantage of that bifocation between the research environment where a, by definition, there are h an experts in the loop who are looking at the output. If the thing tries to string together G A T C and then F creeps in there, the the h an researcher will know hang on a minute, something's gone severely off the rails here. Uh, versus the sort of post-research environment where you've got clinical trials or you've got an actual product in the field that you're commercializing, and those users have very different requirements. As you say, they're probably not looking for creation, they're looking for a more predictable response. Uh, there is probably a known good truth or ground truth that is important that will matter to the users, will matter to the patients, will certainly matter to regulators. Uh, and so the adoption there is is a rather different thing. Especially we always see, I mean, it happens every week or most lately, it seems, that we read about, say, lawyers who present a brief and there's case law, there are precedents in there, at least part of which have been hallucinated by the AI in response to the prompt. And this normally happens, it it later turns out when the investigation goes through, because somebody just got overexcited and they used one of the public systems, ChatGPT or one of the others of its ilk, rather than something that's more specialized in the law that is provided by the law firm itself with some guardrails and safeties put around it. So it's going to ask, I mean, pres ably in pharma, your users are we would hope, a little bit more sensitive than most to those topics, but still there's got to be that FOMO, that pressure, you know, do something with AI. Uh, how do you address that? How do you try to, on the one hand, head off the excesses, but on the other hand, give them something that they can they can work with, they can do their jobs with.
Hassan:Okay, I mean it's a it's a good question. I mean, the way I've dealt with it, if I go back to architecture, this is an architecture conversation. All right. Now, what we've done is we've segmented the architecture into the two halves. You've got the research half and you've got the development half. Okay. The research half you can innovate. In the development half, where you're dealing with clinical trials and so on and so forth, you can't mess with the data. It the you're collecting data, it has to be the way it is, because that's what you're submitting to the regulators. Okay. But what you can put in place in the development plan is more productivity tools, right? So think of co-pilot, for example, taking minutes or doing s mary of meetings and things like that. You can do that kind of stuff. You're not messing with the actual data itself, right? But then there's another part where, for example, if you've got a data set that has come in and you need to generate a narrative of the data, i.e., you've got a graph or a table with figures and listings in it. Can you do a narrative of that? And then the h an would validate is that narrative what the data is saying, right? And then you can then publish that up. So those are the kind of things the natural language system, , narrative generation, structured content authoring tools that we are looking at in the development space.
Jon:Yeah, we're we're we're a little way behind that. We're starting up a project now, but one of the things we're looking at before we open up these wider tools like Copilot is is looking at data security, , you know, and doing a solid assessment on our data landscape to make sure that people aren't gonna find things that they shouldn't have access to and so on. Um so you know, there's there's quite a big load of work there for us to do that. It in a way it's quite good because it's gonna mean we get a fairly solid information security perspective on our data relatively early in the company's lifetime. You know, we're gonna be thinking about it when we're only a thousand people big. Um, so that's been that's been quite an interesting journey to go on. And it's in the name of let's work out a way we can enable AI to help drive productivity and value into into the business. But we're we're kind of that early stage at the moment.
Hassan:Yeah. So go going back to the architecture side, there's sort of three categories in my mind that I've divided AI into, right? There's your your lowest category is what I call commodity AI, right? So that's your AI assistants or AI agents for tasks within the office, doing minutes and so on and so forth. You use Copilot for that kind of stuff, right? So that's generic, that's enterprise-wide.
Dominic:Yeah, and it's built into the tools rather than something you need to develop yourself.
Hassan:Exactly. The next level above that is what I would call RN RD AI assistants and AI agents, right? So I'll give you an example. We have a huge, we have something called like a biological insight knowledge graph. Okay, that's a graph capability that has insights in a lot of disease biology and biology itself. And a lot of journal publications are linked into that, okay? Like millions of journal publications from all over the world in the pharmaceutical place. Essentially putting a large language model on top of that, linked into the to the graph technology, so that you can ask it scientific questions that you wouldn't be able to ask your general Chat GPT. It wouldn't be able to answer that kind of in-depth assistant questions, right? So there's that kind of that's the next level up, right?
Dominic:And that's where it starts to be valuable because it's looking at your specific data. If it if John were to try to use it, it wouldn't work because it needs to be wired into that app, that that set of data sets that that exist, APIs that exist only in your environment.
Hassan:In our environment. And you could ask it deep scientific questions like look, I am investigating this target protein as a drug. What other options do I have? Has someone else done something, da-da-da-da, etc.? And it would look into research papers and come back with an answer, for example, right? Then the third level is what I was describing earlier on, where you're doing augmented drug design, for example, and that's where you're getting into heavy engineering and you're building your own models, or you're getting models from academia where they're very specialized models to do certain specific AI type of drug discovery, molecular docking work, and so on and so forth, right? So that's at that at that highest level.
Dominic:Yeah, and that's kind of the exception to something I've talked about in the past that LLMs are rapidly becoming commodities. And yes, there are differences, but they all catch up to each other fairly quickly, they're all leapfrogging each other. There are three or four different products that were launched within a week of each other to do deep research. It's it would not be a market I'd want to be in, very hard to differentiate. You have to keep it running pretty fast just to stay even with the pack. What gets interesting is what you do with those models and your specific data, your specific systems. But then that brings us back to the architecture question, how do you manage that? And John, you're already talking about the security aspects of that. And as you say, you probably have an easier time of it because you're starting with not quite a greenfield blank slate, but less of a legacy. Uh, but how do you think of that, Hassan? Because you of course have a huge estate, a huge variety of systems. How do you choose what is in a f or how do you assess what is in a fit state to be wired up to the AI systems and what needs work before it can be exposed in that way?
Hassan:Okay, so again, we're getting back into the architecture question.
Dominic:Exactly.
Hassan:So I describe to you three layers, three buckets of types of AI systems. But underpinning that, what AstraZeneca has put in place is certain platforms like AI platforms, and then below that is then your security infrastructure, your compute storage, network infrastructure that is dealt with as an enterprise-wide capability. Okay? So they would have the right governance processes. So, for example, if you're saying that you want to bring in a new model into the company and to be used, then it would need to go through the the AI governance process, which would vet it, do the right due diligence, making sure it's not leaking information or there's no security risks to the company and so on, then it would be made available into our AI catalog for it to be used. So you would need to we have those sort of governance processes in place to do that.
Dominic:And was that something that you already had in place that you leveraged, or did you develop new policies from scratch for AI, or is it a combination?
Hassan:It's a combination because, in some sense, what what does a governance process mean? You need to bring in experts who understand AI governance, who understand rules and regulations from the EU and so on and so forth, who can work around these sort of things, understand security, understand risks, because they are the right experts to make the right decisions rather than having an architect, let's say, make those decisions. But what we then try and do is see how we can surface their knowledge, their thoughts as a platform capability that makes it easier for us to enable architects make those decisions, right? But that's a learning process we're going through at the moment.
Dominic:Exactly, back and forth between the two groups. John, does that match with what you're building out from scratch?
Jon:Um, yeah, I mean, we're not right now, we're not building anything out. As I say, we're trying to cons e that kind of AI that comes with things. Um, I've got half an eye on where we go beyond that. But one of the challenges is as you exactly as you said, which is you know the technology is changing every day, the the different learning models that are out there, and AI an AI tech stack is not a simple thing. Um and you need a lot of specialist knowledge actually to make that work. One of the things when I was at AstraZeneca and we were building out some of the first kind of data science platforms for AI, we we went we iterated over that a couple of times before we got it right. You know, it's not not a simple thing to build out, so so I'm kind of trying to do that middle ground between being the the good cop who allows some AI in there and the bad cop who knows how difficult it is and trying to stop it from getting out of control. Um and it can be really hard to to do that. Yeah, exactly, exactly. But I think I think you know it comes back to in a in a in a smaller company like ours, it comes back to where are we gonna drive real value out of this? If we can find the value cases and build on those, if we need to develop something ourselves, then I feel it should justify itself in in terms of an ROI, you know, and I think that's kind of that's what Gartner are pushing as an approach, and it sits quite well with with me.
Dominic:Yeah, isn't that always the trick? What are you actually trying to do here?
Jon:Well, exactly, and and you know I've had a lot of discussions with people saying they're saying oh oh we could we could do this, and actually one of the things that's very important in in my role as the as the enterprise architect is is trying to educate people about what AI is and what it can do, and what it can't do, actually, almost more importantly, because I think there's some grand expectations again because you can put it in and say, give me a holiday plan for going to Brazil and should take me to three great exhibits and take me to the best restaurants, and it and it'd be fairly definitive about that. You know, you can't go in and say, Um, right, our BLA dossier for the next drug that we're going to put forward to the FDA because that's just not going to be feasible anytime soon in the near future. And so then it comes down to well, now let's talk about what that is and how do we break that down and where could AI help along that process and help to bring some data together and assist with those steps in in terms of giving guidance and advice and pointers, but not to the point of being able to just you know click your fingers and these things magically appear. So that that's been some of the challenge for for me.
Dominic:Yeah, there's a fantastic cartoon which I'll have to dig out and put in the show notes. Uh the the robot uprising turned out to be surprisingly brief because all of the AI models have learned from history, and it turns out most battles historically were fought with wooden spears and clubs. So no, that's fantastic. Guy, did you have any closing thoughts as we get to time?
Guy:Well, I guess my next question is as you say, John, you've got a very different world, which is probably where I see a lot of more traditional architects being because they because a lot of companies don't have big RD arms with with the maturity and experience of AstraZeneca. Um when you're bringing in like embedded AIs, because again, this is an emerging thing from what I'm seeing, how do you validate them? Because as because as you say, it's not the it's your your AI, it's you know it's the it's the Microsoft, it's the Salesforce, etc. etc. Um how do you frame some of the concepts of not just the business case acceptable, but the quality of what it gives you back?
Jon:That's a that's a great question. Um so so we are trying to put a little bit of framework around it. I mean it's fairly loose for us, , because because we've only got a handful of tools that actually have AI embedded. But basically, we'll get asked generally as IT, quite often with these tools, what we're seeing is there's a kind of sign-up step where you have to say, I understand the terms and conditions associated with the AI. And I always like that when the tools do that because it it's actually stopped the business and asked having have them come to us to say, Am I am I allowed to tick this box? which is which is good. Um and that gives us an opportunity to go and read the T's and C's and make sure that we're not giving our data away and all those kind of good things. Although most of this embedded stuff is fairly, fairly safe from what I'm seeing.
Dominic:Your users are impressively well trained.
Jon:But then, but then I mean it really it's just a case of of getting some testing in there to see what what these things do. And that is actually a challenge because a lot of these systems, if they're SaaS systems, they're not necessarily big systems that we have. We don't necessarily have a sandbox or even a development environment for some of these things because we're buying them as a service. And so sometimes yeah, you actually just have to turn these things on and try them, or or get a demo from a salesperson. Um, and that's a little bit of a challenge for us to be honest. And I can see as we get more and more of these things, , it's going to get a bit riskier to do that. So it's something we're kind of going with the flow on at the moment, but but it's it's a great question because it's something we do need to keep an eye on, I think.
Hassan:Yeah, no, I I think look, just just as a final wrap-up, I just want to make a few points. I mean, I know I painted a picture of AI and how we're using it and the scenarios and the categories and so on, but I want to just kind of talk about a few limitations that that that I can see, right? So there are three key limitations that I have in my mind, right? One is domain specialism, right? So when you're building AI systems or solutions, in some sense they are very domain-centric, in the sense that, let me give you an example. If I built a machine learning solution that played checkers, it would not be able to play chess because it has not been trained on data that has played chess, so it wouldn't have that mental model of chess. Okay, so that's one thing. So hence the reason why we call it narrow AI. Likewise, if we talk about large language models, it does language really well, but if you give it a very detailed mathematical equation to solve or planning tasks to do, then it falls apart because that's not what it's built for, unless you have multimodal AI where you start stitching together multiple models or different domain specialisms together.
Dominic:Okay, that's where the new multitude of experts models come in, as you have different aspects of the system that have different capabilities and you wire them up together.
Hassan:Exactly, exactly. Then the second item is what I call the world view, okay? Now, the world around us is a very gnarly place. Think about it this way: we have autonomous driving cars, some of us do, we use those cars, but they don't really work in London streets. Okay, but they work really well on the motorway because the motorway is a very structured environment. Okay, you're not going to have unprecedented situations that you need to deal with that you may not have been trained with. Okay, so that's another thing. So when I was talking of protein folding or any of the molecular simulations, you don't need a world view there. It's a structured environment. You've dealt with it as a structured problem. Hence, AI and alpha fold does really well over there. But it would not do well, you wouldn't be able to put alpha fold in a car to drive around the streets in India, for example. It will find it very difficult because its worldview would be very complex. Okay. The third issue that we have with AI is what we call explainability, right? Especially with deep learning. You don't really know what's happening in the box. Okay, so then what you're saying is that okay, then how can I just use this in an area in a tool as a tool to achieve my objective? So, like I was saying, if I'm screening molecules, fine, do I need explainability? No. If it hallucinates a bit, does it matter if it's created an extra experiment for me? Doesn't matter. I have ways of validating that, of testing if the molecule is stable, etc. Exactly, right? So then what you try and do is you try and understand the context you're in, and then look at the tool, look at its limitations and its capabilities, and then apply the tool in the right context, and then you're in a good place.
Dominic:I think that is a good thought to leave with our listeners, just to going back also to what John said, you know, what are you actually trying to achieve? Start with the end in mind, not with how do I use AI, but what am I trying to do? What data do I have, what AI capabilities exist, and how do they map to what I'm trying to do into the context, regulatory security, etc.
Guy:Yeah, and I was gonna say I think Hazan's description of it's almost going right back to the concept of you know what domains are different technologies suitable for.
Dominic:Yeah.
Guy:Um it works very well. Um gentlemen, it's been a real pleasure and a fascinating conversation. So for me personally, thank you for your time. Thank you.
Dominic:Thank you very much. Absolutely, thanks for coming on. And for the listeners, by all means do check out the Enterprise Architecture Experience. We'll put links in the show notes, and you can hear a lot more from Hassan and from John and from their guests. But for now, thank you for listening to the Enterprise Alchemists, and we hope you all tune in again next week.
