ITIL AI Governance (Version 5): From informal AI use to effective governance

Mark Bassham, Senior Project Manager

Many organizations already use artificial intelligence, often beyond formally approved systems and processes. By supporting research, decision-making and everyday work, AI can help employees work faster and create new value. However, as its use expands, organizations need to understand how AI is being used and ensure that its benefits are realized without losing control of the risks.

In this article, Mark Bassham, a beta tester for ITIL AI Governance (Version 5), draws on his experience as a consultant to explore the challenges of governing both formal and informal AI use. He looks at how organizations can establish clear boundaries, monitor AI use and outputs, and still give people room to experiment and create value.

While AI is now part of many organizations, the question is whether they know where and how it is being used.

A gap exists between formal AI adoption and informal use, with employees increasingly using AI without the organization’s knowledge or approval.

In my role as a consultant, I help organizations identify and resolve these gaps. Visibility into AI usage is essential, as informal practices can create significant blind spots. For example, an organization may be unaware of what data employees input into AI tools, where that data goes, or what outputs are being generated. This could lead to strategic information inadvertently shared with public AI services, or release of GDPR-protected data without appreciating the potential consequences.

However, individuals cannot bear this responsibility alone. Organizations must establish a framework that clearly defines what information can and cannot be shared, where it can be shared, and when to use a private AI service instead of public.

Balancing value with risk

The benefits of AI are significant, especially when used as a co-worker to support individuals. I use AI to, for example, complete research tasks in minutes rather than half a day.

That use isn’t going to stop. Individuals and organizations benefit from using AI in this way. But the organization must grasp how employees are using AI and establish governance so it can deliver strategic outcomes while protecting the enterprise.

AI differs from many other technology implementations: it is a flexible, dynamic platform, whereas traditional systems are generally more contained; you know what goes into them, what comes out and, broadly, what they are designed to do. With AI, you may know less or none of this. As a result, governing what feels like the Wild West is difficult.

Governance needs to span the organization

One key practical lesson I took from ITIL AI Governance (Version 5) was the importance of understanding where governance sits within an organization. For some, it is associated with the board while, for others, it is primarily linked to regulatory control.

The ITIL AI Governance model looks vertically through the organization, considering how AI is measured and managed at different levels.

Making ethics part of AI governance

I found the ethical element of ITIL AI Governance (Version 5) particularly interesting because it is not something traditionally covered in technology implementations. In large projects, organizations usually focus on regulatory and compliance requirements in their specifications.

I encountered this while working with the government sector on services provided to a community where about 25 per cent of residents did not have bank accounts and dealt exclusively in cash. When developing policies, it was essential to consider how those policies would affect this segment of the community.

An AI tool may generate an answer to a policy question but, without considering the ethical implications, the resulting policy could severely disadvantage people without access to banking and, potentially, many other online services.

Monitoring cannot be an afterthought

I was particularly impressed by the measure-and-monitor concepts covered in ITIL AI Governance (Version 5). Proactive monitoring and feedback are essential. With AI, the volume of data and its flexibility make monitoring and management especially important. Stakeholders also need that visibility. When people encounter the word “hallucinate”, there is a risk that they dismiss the technology without understanding the underlying issues.

I recognize the importance of monitoring in my own work. I manage a small AI-based ledger system and it’s easy to make changes without realizing their impact on other areas, such as a small tweak corrupting data elsewhere. Monitoring ensures that outputs are aligned with the organization’s needs.

Creating boundaries without stopping innovation

AI is a platform for continual experimentation and improvement, but it needs clear boundaries to happen safely. Organizations need to set clear policies at the top level: for example, a rule might specify that certain types of data cannot be used with public-facing AI services. These guidelines need building into organizational governance so that, at the operational level, people have clear expectations about how they can use AI.

There is also a strategic aspect to consider. Employees are hired to achieve specific organizational objectives. AI may make experimentation easier, but it still needs to support the objectives.

This becomes particularly important as people use AI for co-creation rather than simply carrying out defined tasks. I recently created something for the first time through a fluid conversation with AI. We suggested different things and ended up with a product that was far superior to the original idea.

The human still directs the process, but AI contributes to the outcome. You need to give people clear “railway tracks” within which they can experiment while still working towards the organization’s goals.

Govern what is already happening

My advice is simple: find out what is happening with AI in your organization now. With that oversight, you can put governance around AI for the right reasons. Otherwise, you risk facing problems such as a GDPR breach or revealing corporate secrets on a public platform.

That is where I see the value of ITIL AI Governance (Version 5): helping organizations gain oversight of a technology that is already in use and start governing it appropriately and proportionately.