ITIL AI Governance (Version 5): Building governance before building AI

Anil Kaura, Founder & Chief Architect, Metanoia Auctus Intelligence

A new standalone certification requiring no prior ITIL qualification, ITIL AI Governance (Version 5), is designed for professionals and organizations moving from AI experimentation to responsible, trusted, and scalable adoption. This demands effective governance to ensure innovation is responsible, transparent, and aligned with organizational objectives.

Beta tester for the module, Anil Kaura – Founder & Chief Architect of Metanoia Auctus Intelligence (MAI) – explains why effective AI governance should start before building the first AI application. Drawing on his experience developing AI-native applications, he explores how ITIL AI Governance (Version 5) provides practical guidance for understanding AI capabilities and building governance into AI from the outset.

When working as part of a team developing one of the first AI governance models for a major bank, this was still an emerging discipline. Today, organizations are thinking much more seriously about how to govern AI.

At MAI, we are developing AI-native applications for the not-for-profit and community sector, supporting areas such as governance, strategy, transformation, and executive decision-making. Unlike many software platforms that have incorporated AI as an assistant, we place AI at the centre of everything we build. This means we must build governance into everything we do from the start.

And that meant developing our data governance and AI governance policies. This sequence is important, as organizations should not focus on building AI first and think about governance later. By doing this, you establish clear governance principles before development begins, giving teams the confidence to innovate within clearly defined guardrails.

Understanding capability before applying governance

Establishing a governance framework first naturally raises another question: what exactly are you governing? One of the standout features of ITIL AI Governance (Version 5) is the ITIL AI Capability Model, which sets out the six capabilities that influence how organizations adopt and use AI.

Organizations need to understand the capability they are creating. Without that, it is impossible to determine the level of governance, oversight or accountability needed. I believe the ITIL AI Capability Model is central to AI governance because it provides a solid starting point. After completing the certification, I returned to every Minimum Viable Product (MVP) currently under development at MAI and classified each capability using the model before refining its governance framework.

Unlike data governance, AI governance is not a one-size-fits-all approach. Capabilities require different levels of oversight, approaches to human involvement and consideration of ethics, bias and accountability. Once you understand the capability, you can begin applying the governance structure that best fits it.

Governance must evolve alongside AI

AI governance must evolve alongside AI itself. AI is advancing at extraordinary speed and if governance becomes too rigid it will simply be left behind. ITIL AI Governance (Version 5) doesn't prescribe rigid rules but provides guardrails. I often liken it to setting upper and lower limits: within these boundaries, organizations have the freedom to innovate. But move beyond them and this needs further oversight.

As AI models are inherently opaque – and the way they are developed often forms part of the developer's intellectual property – this makes flexible governance essential, with organizations tailoring their approach according to the capability in development, the level of human oversight required and the risks involved.

Building confidence at board level

In my experience, boards are primarily concerned about the risks associated with using technology they do not yet fully understand, rather than the capabilities of AI itself.

Many directors are looking for practical guidance to understand what effective AI governance looks like, without having to piece together information from multiple disconnected sources.

This is where ITIL AI Governance (Version 5) makes a real difference. It provides a structured framework for assessing AI capabilities and determining the level of governance they require. Whether an organization needs a lighter-touch or a more comprehensive governance approach, it gives directors a practical basis for deciding the level of oversight needed.

Governance and the lifecycle model

Another especially useful aspect of ITIL AI Governance (Version 5) is its approach to lifecycle management. Unlike traditional data governance, AI lifecycles cannot be viewed as fixed. Capabilities evolve rapidly, which raises important questions about what happens when these lifecycles end. What happens to the outputs generated by AI systems and their interactions? Where should this information be stored and for how long?

Rather than prescribing a rigid sequence of activities, the lifecycle model offers adaptable building blocks that organizations can tailor to their own circumstances. This flexibility more accurately reflects the reality of AI, as governance must evolve in tandem with the technology itself.

Building AI on strong foundations

As organizations continue to embed AI more deeply into their operations, I believe governance should never be treated as an afterthought; it needs to develop alongside AI itself.

At MAI, we are guided by one principle: every member of a community organization should be AI-capable, not just the leadership team. When everyone understands how to use AI responsibly, the whole organization is better equipped to make informed decisions, strengthen oversight, and ultimately achieve a greater impact.

That is why I believe ITIL AI Governance (Version 5) is such a valuable certification. Rather than prescribing a one-size-fits-all approach, it helps organizations understand their AI capabilities and apply proportionate governance, providing a practical framework to build governance across products, services, operations and decision-making from the outset and adapting it as AI capabilities change.