News & Announcements ITIL AI Governance (Version 5): how to deploy appropriate AI controls

Governing AI in organizations – new ITIL guidance is making a difference

Featuring Kaimar Karu, ITIL AI Governance white paper co-author/ITIL Transformation (Version 5) lead author and Gabriel Espinoza, senior solutions director – Apex Systems

When it comes to the development of AI and its impact on the world, the Financial Times’ chief economics correspondent – Martin Wolf – sees many of its aspects as nothing less than “existential”.

Alongside AI’s opportunities, he notes how “this transformative technology also threatens fundamental values, including personal and institutional accountability, the rule of law, democracy and even what it means to be human”.

Even AI businesses, Wolf adds – whose interests depend on the technology – are suggesting caution: Anthropic, for example, wishes it could “slow the development of this technology to give ourselves more time to deal with its immense implications”.

Finally, he highlights how “AI will be hard to regulate successfully” because of its widespread use and competition in the market between businesses and superpowers.

So, what does this mean for professionals in IT, service management and other roles who are facing the ever-emerging proliferation of AI tools in their organizations?

Towards an understanding of AI impact

Earlier this year, an article on ITIL.com from two co-authors of the ITIL AI Governance White Paper – Stephen Mann and James Finister – noted how, despite the claim that AI guardrails exist within service management tools, this isn’t nearly enough to effectively govern AI.

They commented that “governance is about responsibility, accountability and finding an appropriate governance model that allows an organization to use AI safely,” and this led to defining several perspectives on how AI affects technology governance, namely:

  • •  Decision authority and risk management: who/what has decision-making power in AI-enabled environments and how do you govern the risk?
  • •  Ethical principles and responsible AI: AI presents an ethical risk when organizations use it without considering the impacts.
  • •  Data governance and performance management: data governance problems are inherent when using AI, including disclosure of sensitive information.
  • •  Regulatory compliance and operational standards: AI systems should comply with data protection laws, intellectual property rights and other emerging legislation.

The work of Finister, Mann and other co-authors of the white paper – including Kaimar Karu, also lead author of the ITIL Transformation (Version 5) module – brought about the ITIL AI Capability Model: outlining six AI capabilities – creation, curation, clarification, cognition, communication and coordination – and offering a method to map the capabilities against different risks and opportunities.

But how has this knowledge proven useful in the year since it was released?

Bringing structure and guardrails to organizations’ AI discussions

“Working on this paper with fellow authors – who all brought their own viewpoints and experience to the table and different angles – we combined this into a coherent piece that has also helped me to structure my thinking further when discussing AI-related matters with my clients,” Kaimar Karu said.

“And, with those clients, once they have also read the white paper, it has become natural for them to not treat the AI initiatives in their organizations as just technology projects or "a coat of paint on what's already there". We discuss and plan for the whole breadth of the impact of AI technologies on their businesses, starting with their people.”

Gabriel Espinoza, senior solutions director: managed support at Apex Systems – who has authored guidance on combining the ITIL AI Capability Model with ISO/IEC 42001:2023 and ISO/IEC 20000-1: 2018 as an integrated AI governance model – said the original ITIL AI Governance white paper had been “very valuable providing guidance and defining a clear approach about how to apply AI”.

He added: “I use the guidance when preparing solution design for how to apply AI in managed support projects [and this is] very important from my professional and personal point of view. We need to have guardrails about how to use such technology, specifically with data governance, confidentiality and so on.”

Looking through the lens of the ITIL AI Capability Model

Despite the planning that organizations might make before implementing an AI solution, one of the major risks comes from changes that arise further down the line.

Karu explained: “Often, an AI solution is brought in under one banner (i.e., one of the 6 Cs) but once the implementation begins, the preparations – procedural, legislative, financial, etc. – are revealed as insufficient.”

Though the governance (responsibilities, accountabilities, delegation, transparency, escalation) is in place to use an AI tool for data analysis, provide recommendations and automate some of the decision-making based on that information, things often break when suddenly bombarded by unannounced changes to work processes.

“The ITIL AI Capability Model is a great thinking tool, and assessing the plans through the lens of six Capabilities – and then the existing and required governance using the tools described in the white paper – helps make all of this a lot smoother and avoid a significant amount of unnecessary pain. Perhaps most importantly, you can steer discussions between teams in a structured way, with fewer hidden assumptions and fewer conflicts,” Karu added.

Enter ITIL AI Governance (Version 5)

Despite the warnings and deep-seated reservations of leading commentators like the FT’s Martin Wolf, LLM-based AI – according to Karu – “is seen by many as a transformational new opportunity; even if organizations are not yet adopting AI-based solutions into their workflows, or believe this should wait, the world around them is already changing.”

And into that world of change, ITIL AI Governance (Version 5) is now available as a standalone certification, requiring no prior ITIL qualification.

“Supply chains are being impacted by the use of AI while many people in organizations are using AI (sanctioned or not), while tool vendors are embedding automatic AI-functionality in their corporate offerings,” Karu added.

“It is crucial for organizations to form a well-thought-through approach to AI when it comes to their internal and external digital products and services and ensure this aligns with their overall approach to product and service management.

“The new ITIL AI Governance (Version 5) certification provides the necessary context and guidance to start working on that.”