Managed Security Services: CISO Does Not Bear Sole Liability
Benedikt Langer
8 min. read In many organisations, the CISO is seen as the person who stands accountable for security. ...
8 min. read · As of: 23.04.2026
On April 22, 2026, Merck announced a partnership with Google Cloud worth up to one billion US dollars at Google Cloud Next in Las Vegas. At its core is an agentic AI platform based on Gemini Enterprise, addressing R&D, Manufacturing, Commercial, and Corporate functions across more than 75,000 employees. For supervisory and executive boards in the DACH region (Germany, Austria, and Switzerland), the deal is more than just a pharmaceutical headline. It serves as a template against which their own agentic AI investments in 2026 and 2027 can be measured. The geometry of the deal deserves a close reading.
What is an Agentic AI Platform? An Agentic AI platform provides an end-to-end layer where agents execute functions as a working plane, rather than merely offering individual models for isolated tasks. It requires a common identity, data, and compliance architecture that can support agents across various business units. Thus, a single use case becomes an application of the platform, not a standalone project with its own infrastructure and governance.
The Merck-Google announcement follows this pattern on an unusually large scale. The official Merck newsroom describes the initiative not as a use-case rollout, but as an enterprise-wide transformation. This sends a clear signal to Merck’s own organization, to competitors, and to regulatory bodies: Agentic AI in pharma is not being piloted; it is being built. Anyone serving on a supervisory board in another industry should take note of the pace the pharmaceutical sector is setting with this move.
Three structural signals warrant an honest board-level assessment. First, the executive involvement: Merck CEO and Google Cloud CEO Thomas Kurian personally announced the deal at Cloud Next, not their respective IT chiefs. This anchors responsibility at the highest level. Second, the scope across all business units: R&D to Corporate Functions is more comprehensive than a typical AI pilot. This demands a platform-centric approach. Third, co-creation: joint engineering teams from both companies are not a standard managed service, but a deliberate decision for deep knowledge integration.
Executive and Supervisory Boards face a practical challenge: How does a billion-dollar bet translate into an AI strategy tailored to their own size and business model? The Merck deal highlights three key dimensions.
The first dimension is the architectural decision, preceding use-case selection. Companies planning AI investments in 2026 should first clarify which foundation platform their organization will commit to. This could be Gemini Enterprise, Azure OpenAI Enterprise, AWS Bedrock with Anthropic, or a hybrid model. This decision has implications for several years and extends far beyond the initial use case. Acting opportunistically here will create strategic inconsistencies.
The second dimension is the platform’s reach. Merck deliberately avoided an isolated solution for a single function. Executives in mid-sized companies should ask which business units would benefit from a shared platform. A platform rarely proves worthwhile for just one area. As soon as two or three functions are integrated, the economic viability calculation changes significantly. The lesson is reach over specialization.
The third dimension is the contract model. A standard managed service differs structurally from a co-creation partnership. Co-creation involves joint teams, shared risk assessment, and collaborative knowledge building. While more expensive to initiate and slower in the initial phase, it pays off in long-term velocity. Executives should honestly assess which contract model aligns with their organization’s risk culture. Those unwilling to embrace co-creation should have the courage not to pursue it.
The reaction of pharmaceutical competitors to the Merck deal is predictable. Pfizer, Roche, Novartis, Bayer, and Boehringer Ingelheim are expected to present comparable packages within the next nine to twelve months. Some will partner with Microsoft, others with Anthropic plus AWS, and some will opt for mixed models. This subsequent wave will also extend to other regulated industries, as the structure of the Merck deal serves as a blueprint.
For DACH (Germany, Austria, Switzerland) executives in manufacturing, logistics, insurance, and banking, this opens a critical window of three to six months. Companies that make their architectural decisions within this timeframe can secure engineering support from platform providers, as hyperscalers are actively seeking reference cases. Once this window closes, engineering support will become scarcer and more expensive. Those who delay until all competitors have announced their packages will pay the price twice: through higher costs and reduced attention from platform providers.
A second observation warrants the attention of supervisory boards. Merck’s announcement fundamentally shifts investor expectations. From May 2026 onwards, analysts will increasingly evaluate pharmaceutical valuations through the lens of whether a company possesses a visible Agentic AI strategy. This expectation is now spilling over into other industries with similar structural logic. Companies unable to communicate a discernible Agentic AI strategy in their upcoming quarterly reports risk significant friction in investor communications.
The right response to the Merck deal is not to make a billion-euro announcement of your own, but to prepare in a structured way. Three months are sufficient for an honest assessment of the current situation and to define an initial strategic direction.
The Merck deal doesn’t provide a blueprint. It provides a reference point. Supervisory boards should use this discussion to clarify three questions. First: By 2026, will we have made a deliberate architectural decision for Agentic AI, or will investments flow opportunistically into individual use cases? Second: Which business unit truly benefits from a shared platform? What sponsorship structure will support the initiative? Third: Which contract model suits our risk culture? How much co-creation do we truly want?
A note from consulting practice is valuable for the latter two points. Executive boards often underestimate the cultural effort involved in a co-creation partnership. Joint engineering teams require clear rules of engagement, open knowledge sharing, and a relationship of trust between the organizations. If one’s own organization is trained for secrecy and insourcing, co-creation becomes a Herculean task. An honest self-assessment at the outset saves friction losses midway through.
Finally, the question of visibility should not be underestimated. Merck deliberately announced the deal on a grand stage. Anyone pursuing a comparable strategy should consider what level of visibility they need and what level of visibility would be detrimental to their own brand. Some organizations benefit from a communicative offensive, while others prefer a quiet build-up. This decision belongs in the same supervisory board meeting as the architectural choice. Both topics are interconnected. Managed Services Discussions in a C-Level Context and Vendor Diversity in AI Architecture gain new urgency due to the Merck announcement.
The official announcement refers to “up to 1 billion USD”. This is standard contractual practice and signifies a maximum amount with milestone-based releases. Specific tranches are released upon achieving agreed-upon stages. A genuine commitment exists for the first 18 to 24 months, after which it will be re-evaluated.
Bayer, Boehringer Ingelheim, and Germany’s Merck KGaA are the most likely initial candidates in Germany. Roche and Novartis from Switzerland have their own AI initiatives, which will be re-evaluated in the coming months. The pace largely depends on the respective board composition.
Mid-sized suppliers in packaging, active ingredient synthesis, and logistics will see increased attention on data and interface topics. Those wishing to work with a corporation on an agentic platform must demonstrate their own data quality and API maturity. Investments in both will pay off doubly in 2026.
Yes, if the supervisory board’s own expertise is limited. An external consultant or an advisory board member with active AI experience creates distance from the internal IT control logic and assists in an honest evaluation of architectural options. The selection should be made carefully, as the consulting market offering in 2026 varies greatly in substance.
Google Cloud, with Merck and its parallel 750-million-dollar partner program, increases pressure on Microsoft Azure and AWS in regulated industries. European providers like OVHcloud, Ionos, and SAP cloud initiatives gain arguments for their sovereignty positioning but need to catch up on the depth of agentic AI platforms.
A central one. Pharmaceutical applications are, in many cases, high-risk applications under the EU AI Act (European Union Artificial Intelligence Act). Those setting up agentic platforms must consider documentation requirements, human-in-the-loop controls, and audit trails from the outset. Anyone who postpones this will face uncomfortable questions in the first audit round in 2027.
Managed Services in a C-Level Context 2026: Build, Buy, or Manage
Meta Muse Spark Closes the Open-Source Door: AI Architecture 2026
From IT Leadership to the Board: What Q1 2026 Appointments Reveal
MyBusinessFuture: Merck x Google Cloud Agentic AI Alliance
Cloudmagazin: AWS Bedrock vs. Self-Hosted AI Inference DACH
SecurityToday: Terrarium CVE-2026-5752 and Sandbox Architecture
Cover image source: Pexels / MART PRODUCTION (px:7222867)