“We adopt AI way faster than we learn how to effectively control it.” That was the warning from Roman Zhuravlev, Senior Architect at ITIL®, in our recent webinar in association with PeopleCert: AI: The governance gap nobody is talking about.
Roman highlighted the scale of the problem: 90% of organisations utilise AI in daily operations, yet only 18% have a fully implemented AI governance framework (LegalFly).
Businesses have embraced AI at speed, but many are still relying on governance frameworks built largely for more predictable technology. AI brings new risks and complexities, not least because of its opacity, autonomy, and capacity to change. That leaves an AI governance gap, and unless it’s addressed, it will only widen as the technology evolves.
Below, we’ve recapped Roman’s key takeaways on where to start when implementing AI governance. Or, if you’d rather hear directly from him, you can watch the full webinar on demand.
👉 Unsure how well you’re managing AI risk? Our free AI risk controls checklist shows what’s missing.
Your existing governance may not be enough
Roman’s view is that existing corporate governance “most likely is not sufficient to effectively govern AI.” He added: “It doesn’t need to be thrown away and rebuilt from scratch, but it needs adjustments.”
AI brings its own governance challenges, and they fall into four areas:
• Autonomy: autonomy in decision-making, plus the need for transparency and explainability.
• Ethical and responsible AI: bias and fairness, as well as hallucinations and mistakes in generated outputs.
• Data quality and security: misalignment between access controls for source data and AI outputs, alongside the availability and quality of data used for AI training.
• Regulatory compliance and operational practices: legal and compliance risks, third-party, and supply-chain governance, organisational readiness and skills, and risks across the AI lifecycle.
The first step in adapting is to understand what you already have and “assess and stress test the current governance system”. Organisations then need to identify the gaps, put temporary bridges in place to address immediate risks, and make longer-term changes so their governance becomes AI-ready.
“Once we establish what is AI-ready today in our governance system, we will need to maintain that readiness,” Roman advised. So AI governance can’t be set up once and left alone. It needs regular reassessment and adjustment as the technology and its uses change.
👉 Related: What is AI governance?
AI governance needs everyone involved
There’s a common assumption that AI governance sits only with the governing body, but Roman made clear that “this is not exactly true”. Different stakeholders have different needs, both inside and outside the organisation.
In a workplace, each group has different interests in how AI is used:
• Governing body: How should we balance AI’s benefits and risks?
• Managers: How can we use AI to support organisational objectives?
• Employees: How should we use AI to improve the way we work?
Those needs may conflict. And if governance is designed around the governing body’s priorities alone, Roman warned, it “will probably remain a paper exercise” and “most likely won’t help to use AI responsibly and effectively”.
His answer is to understand what each group needs, balance those needs, and engage with people, so they understand the controls and “accept and follow them”.
This becomes particularly important when tackling shadow AI – employees using unapproved tools for work. Simply stopping them from using external tools isn’t realistic, so Roman argued that organisations need a “shared understanding of the risks, of the hygiene, of the discipline, of using AI”.
How your governance pattern shapes AI adoption
Changing your governance for AI starts with a look at how decisions already get made in your organisation. Roman outlined four common governance patterns:
• Directive: top-down control through formal hierarchies and processes.
• Guided: central direction with more freedom in how teams put it into practice.
• Federated: authority is distributed across different units but coordinated through shared structures.
• Autonomous: teams largely govern themselves through collaboration and influence.
There are pros and cons to each pattern, and most organisations don’t fit neatly into just one. “You cannot just put your organisation as one point on this grid,” Roman explained. Different aspects of governance, from how changes are approved to how risk appetite is set, may sit in different places.
Knowing where you sit for each aspect helps you find the breaking points when AI is introduced. Once you understand the weaknesses in your existing pattern, you can then adapt it.
👉 Related: Mistakes organisations make deploying AI
Outcomes, costs, and risks: how to assess the value of AI
“We adopt AI not for the sake of adopting AI, but for the sake of getting the expected value,” Roman told the audience.
That makes value the place to start when deciding whether an AI use case is worth pursuing. Drawing on ITIL’s approach to service value, Roman suggested assessing it across three areas:
• Outcomes: What business outcomes could AI enable? On the other side, could it prevent a desired outcome or lead to an unintended one?
• Costs: What costs could AI remove or reduce, and what new ones could it create?
• Risks: What existing risks could AI reduce, and what new risks could it introduce?
Each question cuts both ways to help you make a balanced decision. A use case might promise faster processes or lower costs, but those gains have to be weighed against any extra cost, risk, or negative outcome it brings with it. For example, an organisation might gain speed or efficiency while losing, or never building, the underlying human capability. That trade-off may be worth making, but it still needs factoring in.
👉 More from GEL: What is ITIL (Version 5)?
How to assess AI risks in IT service management
Not every use of AI carries the same risks. As Roman explained, the ITIL AI Capability Model (or 6C model) helps organisations look more closely at what they’re asking AI to do.
The model groups AI use into six capabilities, and most use cases combine more than one:
• Creation: generating something new, such as answers to user questions, code, or automated workflows
• Clarification: Making existing information easier to understand, for example summarising a complex incident ticket or rewriting a knowledge article
• Communication: Helping users interact with services and systems, from technical-support chatbots to virtual agents
• Curation: Improving existing data or knowledge by identifying outdated, duplicated, or inconsistent information
• Cognition: Finding patterns and insights in data, such as detecting recurring incidents or predicting workloads
• Coordination: Taking or orchestrating actions across systems, such as triaging requests, escalating incidents, or triggering remediation workflows
Each capability carries a different risk profile, and these can be mapped against common AI risks on a heatmap that shows where risk is low, medium, or high. That helps organisations prioritise which risks need their attention first. “If you know what you use your AI for, you know what risks to look at first, and you can prioritise your risk management,” Roman added.
Context is important too. Roman suggested looking at the following:
• Data sensitivity: Whether the AI handles personal, confidential, or regulated data
• User impact: The number of users affected and how significant the impact could be
• Automation level: How independently the AI operates and where human oversight is required
• Regulatory environment: Whether the AI use case is subject to specific compliance requirements
• Operational criticality: How important the AI is to business operations or safety
• Stakeholder diversity: Whether the AI serves people across different roles, languages, cultures, or other groups
Combine the capability-based risk profile with the context of each use case, then put the right controls in place.
👉 Related: ITIL 4 vs ITIL (Version 5): what’s changed?
Check your AI risk controls
Our free AI risk controls checklist shows you which controls you have and which you’re missing.
