AI in Service Management

What AI means here

Artificial intelligence (AI) is the broad name for computer systems that perform tasks we associate with human intelligence: recognizing patterns, understanding and producing language, making predictions and decisions. Most AI in use today is built with machine learning: instead of following rules a programmer wrote, a model learns patterns from large amounts of example data. The Artificial Intelligence topic covers how models are trained and how they work inside; this page is about what AI means for the people who run IT services.

PeopleCert describes ITIL (Version 5) as "AI-native": written with AI in mind from the start, while staying independent of any particular technology. AI is not a separate practice in ITIL; it shows up in the dimensions, in the lifecycle activities and in governance, the same way any powerful technology would.

Generative AI

Generative AI (GenAI) is AI that creates new content — text, code, images, audio — in response to an instruction called a prompt, based on patterns learned from very large amounts of training data. The best-known examples for text are large language models (LLMs): they produce an answer by repeatedly predicting a likely next piece of text. That is why they write fluent summaries and drafts, and also why fluent does not mean correct.

At Kestrel, the service desk uses generative AI built into its ITSM tool to summarize long ticket histories for the next shift, to draft replies to customers, and to turn a resolved ticket into a first draft of a knowledge article. Each output is a draft that an agent reads and approves.

Hallucination

A hallucination is output from a generative AI model that sounds confident and plausible but is false or invented: a setting that does not exist, a policy the company never had, a reference to a ticket number that was never created. It happens because the model generates what is likely, not what it has checked.

On a service desk this matters directly. If a virtual agent tells a customer "your contract allows a free meter replacement" and that is not true, Kestrel has a complaint — and possibly an obligation. Common mitigations are grounding answers in approved sources (the system first retrieves relevant knowledge articles and gives them to the model to answer from; this is called retrieval-augmented generation, RAG), showing which article an answer came from, having a human review anything that is sent to customers or changes systems, and making it easy to report a wrong answer. None of these makes hallucination impossible; they make it rarer and easier to catch.

Agentic AI

Agentic AI is AI that pursues a goal by planning and carrying out a sequence of actions itself, using tools: it can query the CMDB, read logs, open or update tickets, run a script, then look at the result and decide the next step. Such a system is often called an AI agent. Where generative AI writes a suggested fix, an agent can try to apply it.

The extra autonomy is where both the value and the risk are. An agent that can restart a server at 03:00 saves the on-call engineer a wake-up call; an agent that misreads a situation can restart the wrong one, or do the same wrong thing on fifty servers in a minute. A practical rule is to match the agent's freedom to the risk and reversibility of the action, as in this sketch of a guardrail:

def decide(action):
    """Decide who acts on a proposal from an AI agent."""
    if action["risk"] == "high":
        return "human decides"
    if action["reversible"] and action["confidence"] >= 0.90:
        return "agent acts, human informed"
    return "agent proposes, human approves"


proposals = [
    {"task": "Add handover summary to INC-21877", "risk": "low",
     "reversible": True, "confidence": 0.97},
    {"task": "Restart portal web node 2", "risk": "low",
     "reversible": True, "confidence": 0.82},
    {"task": "Close 40 duplicate disk alerts", "risk": "medium",
     "reversible": True, "confidence": 0.93},
    {"task": "Reset MFA for a caller", "risk": "high",
     "reversible": True, "confidence": 0.99},
    {"task": "Delete inactive customer accounts", "risk": "high",
     "reversible": False, "confidence": 0.95},
]

for p in proposals:
    print(f"{p['task']:<36} -> {decide(p)}")

Add handover summary to INC-21877    -> agent acts, human informed
Restart portal web node 2            -> agent proposes, human approves
Close 40 duplicate disk alerts       -> agent acts, human informed
Reset MFA for a caller               -> human decides
Delete inactive customer accounts    -> human decides

Resetting multi-factor authentication (MFA) stays with a human even at 99% confidence: it is a favorite target of social engineering, and the consequence of one mistake is an account takeover. Note also that a model's "confidence" score is not a guarantee; real guardrails combine it with permissions that make the worst actions technically impossible for the agent.

AI across the lifecycle

AI can support every activity of the product and service lifecycle. The activities are not a fixed sequence, and neither is this table: it lists typical uses per activity, with examples from Kestrel.

Virtual agents on the service desk

A virtual agent is a conversational AI system — a chatbot or voice assistant — that talks with users in natural language to answer questions, gather details and complete simple requests, handing over to a human when it cannot help. Older chatbots followed scripted decision trees; current virtual agents usually combine a language model with the knowledge base and with integrations that can actually do things (reset a password, check an order status).

Done well, a virtual agent takes routine contacts off the service desk at any hour. Done badly, it traps users in loops. Two rules make the difference: the user can always reach a person, and the person receives the whole conversation so the user does not have to start again.

AIOps

AIOps (AI for IT operations) applies machine learning and analytics to the large streams of monitoring data — metrics, logs, events — that operations teams receive. Typical uses are detecting anomalies that a fixed threshold would miss, correlating many related alerts into one incident, finding the likely root cause from the order in which components failed, and predicting problems such as a disk filling up. At Kestrel's NOC, AIOps reduced the number of separate alerts reaching people, which is the main defense against alert fatigue; see monitoring and event management.

The ITIL AI Capability Model

The ITIL AI Capability Model is part of ITIL (Version 5). It distinguishes six capabilities that AI can bring to an organization, and it makes the point that the right governance, oversight and human involvement differ per capability: checking a generated draft is a different job from supervising an agent that acts across systems. Training material places the model in the information and technology dimension of the four dimensions, and describes the six capabilities as follows (the "6C" model):

The six are types of capability, side by side, not levels an organization climbs through: a team can use Communication heavily and Coordination not at all.

AI maturity

AI maturity is the degree to which an organization is able to use AI effectively, safely and at scale — not only the technology, but also the quality of its data, the skills of its people, how AI is built into processes, and how well it is governed. Maturity models differ in their stages, but the progression usually looks like this: individuals experimenting on their own; a few approved pilots; AI built into specific processes with measured results; and finally AI managed as a normal part of the organization, with governance, monitoring and continual improvement.

Maturity is uneven. Kestrel's NOC may be advanced with AIOps while the finance department is still experimenting. Knowing where you are is the "start where you are" principle applied to AI: build on what works instead of launching AI everywhere at once.

AI governance

AI governance is the set of policies, roles, processes and controls that direct how an organization selects, builds, uses and monitors AI, so that its use is lawful, ethical, safe and aligned with the organization's goals. Its main elements:

• Human oversight: people can understand, check, override and stop AI, with more oversight where the impact is greater.
• Accountability: a named person or team owns each AI use and its outcomes. "The AI did it" is never an answer.
• Transparency: users know when they are talking to AI, and decisions can be explained and traced in logs.
• Data protection: personal and confidential data is only used where it is allowed and safe; see privacy and data protection.
• Monitoring: quality, bias and errors are measured after go-live, not only tested once before.

Regulation applies as well: in the European Union, the EU AI Act sets obligations for AI systems depending on their risk, alongside existing rules such as the GDPR; the United States has no comprehensive federal AI law but a growing set of state laws, and the United Kingdom relies on its existing regulators (see which AI law applies). PeopleCert has also published a separate ITIL AI Governance (Version 5) module, a standalone certification without prerequisites, whose message is governance first, then scale up AI — with guardrails rather than rigid rules.

The guiding principle optimize and automate applies directly: first understand and simplify the work, then automate it. Study material for the new version points out that the principle now explicitly includes effective governance when AI is used. Automating a broken process with AI just produces broken results faster.

Risks to manage

• Data leakage through prompts. Joost pastes a customer's complaint, with name and account number, into a free public chatbot to get a polite reply. That data has now left Kestrel's control. Provide approved tools and make the rules clear.
• Bias. A model trained on past tickets learns past patterns — including, for example, that complaints from one region were handled slower. It can repeat that unfairness at scale.
• Over-automation. Automating decisions that need judgment, or removing the way to reach a human, harms users and trust.
• Hallucination and over-trust. People accept a fluent answer without checking it, especially under time pressure.
• Skills erosion. If junior engineers never diagnose an issue themselves, the team loses the skills it needs the day the AI is wrong or unavailable.
• Security. AI agents hold credentials and can be manipulated by malicious input hidden in emails, tickets or web pages (prompt injection). Give them least privilege, like any other account.