AI adoption has moved, and fast. From LLMs emerging as experimental productivity tools to the systems and solutions now embedded in our everyday work, AI has become unavoidable in most digital workplaces.
Now, the conversation needs to move on, too. “How can we use AI well?” should be followed by “How can we use it responsibly?” – yet many organisations are still playing catch-up on the latter.
Recent IBM research highlights the scale of that challenge. 80% of UK executives surveyed said an AI-related incident had reached their board or C-suite in the last year, but only 35% of those organisations changed their AI governance frameworks or policies off the back of this.
For IT and service management (ITSM) professionals, that makes understanding how AI is governed increasingly important.
So, how do you get AI governance right? In this blog, we explore what AI governance is, why it matters, and the key elements of an effective governance framework.
Plus, for a deeper dive – and a chance to ask your own questions – join our live webinar on 29th October with Roman Zhuravlev, Senior Architect at ITIL®. Register here.
What is AI governance?
At its simplest, AI governance is the framework an organisation puts around how it develops, adopts, and uses AI. It sets out the policies, processes, and responsibilities needed to make sure AI is used safely and responsibly.
Think of governance as the guardrails for AI use within your business. It helps organisations answer practical questions such as:
- Who is accountable for an AI system?
- What data can it access?
- How are risks identified and managed?
- What happens if something goes wrong?
Effective governance takes you from “we use AI” to “we know how we use AI, who signed it off, and what we’ll do if something goes wrong.” It also gives organisations the confidence to explore AI within clear boundaries, while security, privacy, transparency, and accountability are all kept in check.
For ITSM teams specifically, this is important because AI is increasingly built into the technology and services you manage.
👉 More from GEL: Why great digital products can still deliver poor experiences
Why AI governance is important for organisations
As teams rely more heavily on AI, the consequences of getting it wrong grow, too. A clear approach to governance helps organisations:
- Manage risk: AI brings risks around data, security, accuracy, and bias. A consistent approach helps teams spot, assess, and manage those risks across the organisation.
- Limit the potential cost: Poor AI oversight can have serious financial consequences. IBM’s 2026 Cost of a Data Breach Report found that incidents involving shadow AI, where staff use tools nobody has approved, more than doubled in a year. Average breach costs also rose to US$5.39 million, up from US$4.63 million the previous year.
- Make accountability clear: Someone needs to be accountable for how an AI system is used, including who approves it, monitors its performance, and takes responsibility for the outcomes it influences.
- Set limits on how AI is used: Clear boundaries establish where AI can be used, what it can be used for, and where human involvement or additional controls are needed.
- Build and keep trust: How you use AI can affect your organisation’s reputation with the people it serves and employs. Being open about where AI is used, with appropriate oversight in place, can help build confidence in how it’s being managed.
- Keep up with regulation: Rules around AI are still taking shape and vary between regions. Governance gives you a way to track what applies to you and demonstrate how you’re meeting those requirements.
👉 Read next: ITIL 4 vs ITIL (Version 5): what’s changed?
5 key elements of an AI governance framework in ITSM
AI governance frameworks vary from one organisation to the next, but they address a similar set of concerns: protecting data, making AI use transparent, preventing unfair outcomes, establishing accountability, and managing risk. Here’s how they work in ITSM:
1. Data privacy and security
AI tools can process large amounts of information, making it important to control what data they can access and how it’s handled. That includes unapproved tools, too, since staff can paste sensitive data into them without anyone knowing.
In practice for ITSM: Before introducing an AI feature into a service, check what data it can access, where that data is processed, how long it’s retained, and whether it’s used to train AI models. Set clear limits on what information can be shared with external providers, particularly when requests contain personal or confidential data.
2. Transparency
People need to understand where AI is being used and what role it plays in decisions that affect them. This means being open about AI involvement and making its outputs understandable, particularly when they influence service delivery or user experience.
In practice for ITSM: If you use an AI chatbot as part of your service desk, make it clear to users that they’re interacting with AI and provide a clear route to a human when they need further help or want to challenge an answer.
3. Fairness
AI can produce biased or unfair outcomes, so organisations need a way to identify and address potential bias, then continue monitoring for it.
In practice for ITSM: Review how an AI system prioritises and routes tickets at regular intervals, checking that requests from particular users or teams aren’t consistently treated differently without a valid reason.
4. Accountability and human oversight
Every AI system needs clear ownership. Someone must be responsible for approving its use, monitoring its performance, and responding when things go wrong. It’s equally important to decide where human judgement is needed, especially when AI influences high-impact decisions or business-critical services.
In practice for ITSM: Assign a named owner to each AI-enabled service and document their responsibilities. Define what the system can do independently and where human review or approval is required. Automated actions should have clear limits, with a way to intervene when necessary.
5. Risk management
AI risks need to be identified and managed for as long as a system is in use, from its introduction through subsequent changes and updates. This includes considering the potential impact of inaccurate outputs, security vulnerabilities, service disruption, and unintended consequences.
In practice for ITSM: Assess AI-specific risks before introducing a new tool or feature, then reassess them when the system changes or its use expands. Build these checks into your existing change enablement processes. If an AI-enabled service fails, use incident and problem management practices to investigate the cause and prevent a recurrence.
👉 More from GEL: ITIL® (Version 5) guiding principles
AI governance: from principles to practice
What does good AI governance look like in practice? Join Roman Zhuravlev, Senior Architect at ITIL®, for our live webinar on 29th October to explore the AI governance gap in ITSM and how to tackle it.
📅 Date: Thursday 29 October
🕐 Time: 2.30pm (GMT)
🎥 Can’t attend live? Register and we’ll send you the recording.
