Artificial intelligence has firmly established itself in IT Service Management processes: automatic ticket routing, priority suggestions, agent support, chatbots, event correlation, predictive monitoring, workflow automation.

The benefits are plain for all to see. But they come with a new level of responsibility, too.

With the EU AI Act, artificial intelligence governance becomes a legal matter — but above all, an operational one. The European AI regulation came into force on August 1, 2024; some provisions took effect in  2025, while full general application is expected by August 2, 2026.

For CIOs, IT directors, and Service Management leaders, the point is clear: AI can no longer be considered merely an advanced feature of the ITSM platform. It must be governed through processes, responsibilities, controls, documentation, and audit trails. This article focuses on all of these aspects 

Why the EU AI Act Also Concerns ITSM Governance

At the foundation of the EU AI Act is a risk-based approach. In particular, it distinguishes between AI systems with unacceptable risk, high-risk systems, systems subject to transparency obligations, and systems with minimal or no risk.

Many AI use cases in ITSM will likely fall into the minimal risk category: self-service chatbots, agent suggestion systems, automatic ticket classification, intelligent routing, and assisted prioritization. However, don’t take that classification for granted. A chatbot that helps users consult a knowledge base has a limited impact. A system that suggests the priority of a critical incident requires more attention. A workflow that automates access provisioning on sensitive systems must be assessed with even greater care. And so on.

The practical rule is simple: the closer AI gets to an automated decision with significant impacts on access, security, operational continuity, or user rights, the more robust the controls need to be.

AI Governance in ITSM: How to Classify Use Cases

The first step in AI governance in ITSM is building an inventory of AI use cases already active or planned. In many organizations, artificial intelligence enters gradually: first as a function integrated into the platform, then as a chatbot, then as a suggestion engine, then as automation connected to external systems. And this is often very sensible. For each use case, therefore, it is useful to ask:

• Does the system make autonomous decisions or only provide suggestions?
• Does the output have an impact on users, access, security, or operational continuity?
• Is human oversight provided?
• Are personal data or critical information being processed?
• Does the user know they are interacting with an AI system?

In practice: chatbots and virtual assistants for IT self-service will often be limited risk, especially when they interact directly with users. Here the main requirement is transparency: the user must know when they are interacting with an AI system and must be able to access a human operator when necessary. Agent suggestion systems will often be limited or minimal risk, provided the agent retains final control. Intelligent ticket routing and automatic incident prioritization, on the other hand, must be governed carefully, especially if they influence the response to security incidents, critical outages, or essential services. Pay close attention to AI-assisted access provisioning, which requires a specific assessment. If the AI suggests the correct group, the risk may remain limited. If, however, it approves or revokes access automatically on sensitive systems without adequate supervision, the risk profile changes.

Predictive monitoring systems, event correlation, and anomaly detection must also be assessed based on the degree of autonomy: do they produce only alerts and recommendations, or do they automatically initiate corrective actions?

As this shows, the scope of EU AI Act compliance is broad, complex, and constantly evolving.

Documentation and Audit Trail

A mature ITSM environment is already built on traceability. Every ticket has a history, every incident has a timeline, every change has rationale, approvals, anticipated impacts, and outcomes. AI governance requires extending these principles to AI-assisted workflows: this is the key point.

Specifically, documentation should clarify at least five aspects:

• purpose of the AI system;
• scope of use;
• data used;
• outputs generated;
• audit trail.

The audit trail is particularly important. Every relevant AI suggestion or decision should leave a trace: essential inputs, generated output, confidence level, the agent who approved, modified, or rejected the recommendation, and the final action taken.

The point is not to create bureaucracy, but to create operational memory. Without memory there is no audit; without audit there is no governance.

Integrating Explainability into Workflows

Explainability is a decisive aspect of AI governance in ITSM. It must not remain a strictly technical concept. It must become part of the daily experience of agents and process owners. In practice, if the AI suggests a priority for a ticket, the agent must be able to understand why that priority was proposed: similar tickets, the asset involved, SLA, impacted service, historical patterns, risk indicators.

If the AI supports a provisioning workflow, it should show the logic behind the recommendation: the user’s role, department, similar requests, applicable policy, any exceptions.

A detailed technical explanation is not always necessary. What is needed is operational explainability: clear enough to allow a competent person to evaluate, confirm, or correct the suggestion.

Otherwise, the use of artificial intelligence risks turning into something “magical” that cannot be questioned — which would be dangerous

Human Oversight and Responsibility

This leads directly to another key point. Human oversight is one of the pillars of AI governance in ITSM. But not all workflows require the same level of control. A suggestion to update an FAQ may require light review. A priority recommendation for a critical incident requires greater attention. An automation that modifies access, configurations, or assets must include more robust controls. For operational purposes, it is useful to distinguish between three levels:

• Human-in-the-loop: the AI suggests, but the action is only carried out after human approval. This is the most appropriate approach for access provisioning, high-impact changes, and critical incidents.
• Human-on-the-loop: the AI operates within predefined limits, while the team monitors, receives alerts, and can intervene. This is useful for repetitive automations with controlled risk.
• Human-out-of-the-loop: the AI or automation operates without direct human intervention. This should be limited to standardised, reversible, well-documented, low-impact cases.

The risk to avoid is invisible automation. Every automated process must have an owner, escalation thresholds, blocking criteria, and a rollback procedure. To put it briefly: AI can accelerate processes, but responsibility remains — and must remain — human.

A Practical Roadmap for AI Governance in ITSM

To make AI governance in ITSM concrete, it is best to proceed in progressive steps.Here are seven, summarized briefly below:

1. Create an inventory of AI use cases already active or planned.
2. Classify each use case according to risk level, providing justification for the assessment.
3. Define owners and responsibilities: business owner, technical reference, compliance and security point of contact.
4. Introduce minimum documentation requirements: purpose, data used, outputs generated, human controls, logging, performance metrics, review policy.
5. Integrate explainability into workflows, making it visible to agents and process owners.
6. Update change management policies: every significant change to a model, an automation rule, or an AI integration should be treated as a relevant change.
7. Train the teams. AI literacy concerns the service desk, incident managers, change managers, asset managers, platform administrators, and process owners.

Conclusions

Artificial intelligence is transforming ITSM: it reduces response times, improves classification, supports agents, lightens the service desk workload, anticipates anomalies, and makes the user experience more seamless. But the more AI enters processes, the more it must enter governance.

The EU AI Act should not be read as a brake on innovation, but as a framework for making it more reliable, sustainable, and defensible over time. For CIOs and IT directors, this is an important opportunity: to bring the discipline of ITSM into the governance of artificial intelligence.

FAQ

What does EU AI Act compliance require?

It requires transparency, documentation, traceability, human oversight, and controls proportionate to the risk of each AI use case.

What does AI governance in ITSM mean?

It means defining rules, responsibilities, controls, and processes for the use of artificial intelligence in IT Service Management platforms. It includes risk classification, documentation, audit trail, human oversight, explainability, data security, and the involvement of legal and compliance functions.

Where to start to align ITSM with the EU AI Act?

With a census of AI use cases already active or planned. Then they must be classified by risk level, owners and responsibilities defined, data and outputs documented, audit trail and explainability integrated, change management policies updated, and teams trained.