CIO: modernising the core while enabling responsible AI

Boards may ask a CIO to accelerate AI, reduce cost, modernise legacy systems, improve cybersecurity and support continuous business change at the same time. Those goals can compete for people, capital and management attention. The appointment should therefore be framed as a set of choices and an operating mandate, not a catalogue of technologies the candidate must know.

In banking, the ECB's supervisory priorities emphasise both operational resilience and coherent digital and AI strategies. Other sectors face different formal requirements, but the underlying leadership tension is familiar: innovation depends on foundations that can be costly and less visible than a new product demonstration.

Make the constraint visible

A CIO candidate should be able to diagnose whether the limiting factor is data quality, architecture, integration, delivery capacity, vendor dependence, security or unclear business ownership. An organisation can buy a sophisticated AI tool while leaving the data and workflows that make it useful fragmented. The leader's job is to explain what can be done now, what requires investment and which shortcuts create unacceptable exposure.

This demands a partnership with business leaders. The CIO should not be expected to invent every use case, nor should business units bypass technology governance when a tool appears easy to buy. The mandate must state how priorities are set, who owns the benefit and how technology choices are made across the enterprise.

Assess sequencing rather than slogans

Ask candidates to describe a modernisation they led while maintaining service. What did they replace, contain or leave alone? How did they protect critical operations during migration? Which risks did they accept, and who agreed? How did they know that the new foundation created business capability rather than merely a cleaner architecture?

Then ask about an AI-related initiative. Did it rely on those foundations? What data-routing, access and provider questions arose? What could be done locally or within a controlled enterprise environment, and what would need targeted external services? The candidate need not endorse a particular model architecture, but should be able to govern one with security, privacy and business colleagues. Specific claims about Evense's own local model and frontier-model controls remain subject to separate technical and legal validation and are not assertions in this article.

Build an executive technology function

A world-class CIO should develop the leadership bench beneath them: architecture, operations, security, data, delivery and vendor management. The board should ask whether the candidate has built a system that can make good decisions without relying on their constant intervention. This is particularly important when the technology estate contains both long-lived core systems and rapidly evolving AI tools.

The search should also test candour about technology debt. An impressive AI roadmap can conceal an underfunded core. Ask the candidate to describe a time they told the board that an attractive new capability had to wait for a less visible foundation, and how they kept the business engaged while that work was done. The answer shows whether the CIO can connect architecture to strategy rather than present modernisation as a purely technical preference.

Four questions refine the search:

• Which core systems and data weaknesses constrain our strategy today?
• What must remain stable while we modernise?
• Who owns business value, technology choices and risk at each stage?
• What evidence shows the candidate can sequence investment and build a durable team?

The strongest CIO does not present modernisation and innovation as rival agendas. They make the trade-offs explicit, protect the service the organisation already owes its customers and build the foundations on which responsible new capability can stand.