With the entry into force of the EU AI Act, the requirements for the productive use of artificial intelligence are undergoing a fundamental shift. While companies have primarily focused on evaluating the potential of generative AI, copilots, and AI agents, attention is now increasingly turning to the question of how AI systems can be operated in compliance with regulations, in a traceable manner, and under control.
Three key findings are emerging:
1. The EU AI Act Makes AI a Governance Issue
In the future, AI systems will no longer be viewed solely as technology. Depending on their risk level and intended use, requirements will arise regarding transparency, documentation, quality assurance, and human oversight.
2. Many of the requirements are similar to existing service management principles
Concepts such as service owner, change enablement, risk management, configuration management, and continual improvement already address issues that are relevant to AI governance.
3. ITSM can become the operational foundation of AI governance
While legal and regulatory requirements define the framework, established service management processes can support their practical implementation in day-to-day operations.
Trend Snapshot
The first wave of AI adoption was shaped by one central question:
"Where can we use AI?"
With the increasing prevalence of copilots, AI agents, and automated decision-making mechanisms, the discussion is now shifting toward:
"How do we ensure that AI is used in a transparent, secure, and compliant manner?"
The factors driving this trend are:
- increasing regulatory requirements
- the increasing use of autonomous AI systems
- higher standards for transparency and traceability
- Growing Risks Due to Poor Decisions
- stricter audit and compliance requirements
This becomes particularly relevant when it comes to AI agents. These systems no longer merely assist users in gathering information; they can independently initiate activities, prepare decisions, or execute processes.
This gives rise to new requirements for management, oversight, and accountability.
- The EU AI Act as a Governance Framework
- The EU AI Act takes a risk-based approach.
The focus is not on the technology used, but on the question:
What risks does an AI system pose to people, organizations, or processes?
For businesses, the following four topics are particularly relevant:
- Relevant Requirements
In the future, organizations will need to pay closer attention to the following:
- which AI systems are used
- which decisions are influenced by AI
- what risks this poses
- how results can be verified
- how human oversight is ensured
This effectively creates a need for a structured AI service portfolio.
2. Governance Structures
As the use of AI increases, new governance issues arise:
- Who approves the use of an AI system?
- Who is responsible for technical matters?
- Who assesses risks?
- Who monitors quality and compliance?
- Who decides on changes to models or agents?
Many companies do not yet have clearly defined roles and responsibilities in this area.
AI agents, in particular, clearly illustrate this trend, as they are increasingly able to carry out tasks and processes on their own.
3. Documentation Requirements
A particular challenge arises from the increasing requirements for verification and documentation.
In the future, the following will be relevant for many organizations:
- Which AI systems are currently in productive use?
- What data is processed?
- What decisions are being made?
- What risks were assessed?
- What changes were made?
- Who approved these changes?
This gives rise to requirements that will already be familiar to many ITSM organizations.
4. Impact on ITSM Tools
The real challenge often lies not in the regulation itself, but in its operational implementation.
Modern ITSM and ESM platforms can play a key role in this regard:
- Service Catalog for AI Services
- CMDB for AI Components and Dependencies
- Change Enablement for Model Changes
- Knowledge Management for Policies and Documentation
- Risk Management for AI Risks
- Reporting and Dashboards for Governance Metrics
As a result, the service management platform is increasingly evolving into an operational control and governance platform for AI services.
Why is this relevant, and what impact does it have on ITSM and ESM?
Many of the requirements of the EU AI Act can be directly mapped to existing service management practices. These include, for example:
Service Catalog Management
AI systems require a transparent description of their functions, responsibilities, and terms of use. Companies need transparency regarding which AI services are offered, used, and for which they are responsible.
Change Enablement
Prompt adjustments, model changes, or new agent capabilities can have a significant impact on results and risks.
As a result, questions such as the following are becoming increasingly important:
- When does a change require approval?
- Who assesses risks?
- Who decides whether production can proceed?
Configuration Management
AI systems often consist of several components:
- Foundation Models
- Agents
- Sources of Knowledge
- Interfaces
- Automation
These dependencies must be documented transparently.
Risk Management
In addition to traditional IT risks, new issues are emerging:
- Factual errors
- Inaccurate or misleading recommendations
- Bias
- lack of transparency or traceability
- Data Protection and Compliance Risks
Knowledge Management
Documentation is becoming a key factor for success. Organizations need transparent information about the use of AI, its risks and limitations, as well as responsibilities and changes.
The SERVIEW Perspective
From our perspective, we are currently witnessing a trend similar to that seen with the introduction of cloud services or digital platforms. Technology is evolving much faster than the associated governance structures. In our current client projects, we are observing three recurring challenges in particular:
1. Lack of transparency regarding the AI systems used
Many companies are already using copilots, department-specific AI, or agent solutions.
However, there is often no central directory containing:
- Responsible Parties
- Risks
- Areas of Application
- Business Relevance
2. Unclear Responsibilities
This question often remains unanswered:
- Who is the service owner?
- Who conducts risk analyses?
- Who approves new AI features?
- Who is responsible for wrong decisions?
3. Lack of integration into existing governance and ITSM structures
AI initiatives are often viewed as innovation projects.
As a result, the following are often missing:
- Service Descriptions
- Change Processes
- Governance Rules
- Quality Metrics
- Life Cycle Management
In our view, sustainable AI governance will only be successful if AI systems are not treated as special cases but are consistently integrated into existing service management structures.
Takeout
1. View AI as a service
Every AI system used in a production environment should be treated as a service:
- Service Owner
- Service Description
- Quality Goals
- Governance Rules
- defined life cycle
2. Leverage Existing ITSM Structures
Many of the requirements of the EU AI Act can be addressed through existing practices:
- Service Catalog Management
- Change Enablement
- Configuration Management
- Risk Management
- Knowledge Management
- Continuous Improvement
3. Define responsibilities early on
The key governance question is not:
"What kind of AI do we use?"
Rather:
"Who is responsible for the results of this AI?"
Conclusion
The EU AI Act makes it clear that, in the future, artificial intelligence will be not only a technological challenge but, above all, a matter of governance and management.
This opens up a new role for ITSM and ESM organizations: Instead of managing exclusively technical services, they will increasingly be responsible for the transparency, manageability, and compliance of AI services.
Organizations that begin today to systematically integrate AI solutions into their service management structures are laying the foundation for compliant, scalable, and trustworthy use of AI.
The future belongs not to the companies with the most AI systems, but to those that can effectively manage, document, and take responsibility for their AI landscape.
