This is the second post in a series on Generative AI and it’s impact on Information Technology departments. I chose Service Desk as that’s the point where most people interact with IT and it can, as a result, affect the perception of IT - it is really visible (and often people have an opinion about it).

For a while, AI in service management mostly meant better search, chatbots, routing, and some automation around repetitive tasks. Useful, but still fairly contained but that is changing. Taking a look at the current generation of service desk tools they are moving from “help me answer this ticket” toward “help me understand, decide, act, and close the loop”.

That shift changes the work, the operating model, and the risk profile.

What is it?

The service desk is moving through the same maturity path we are seeing elsewhere in enterprise AI adoption. The early use cases are assistive. AI helps analysts summarise tickets, draft responses, search knowledge articles, classify requests, and reduce the time spent writing or finding information, which is valuable but not the end state.

The more interesting shift is that service desk platforms are beginning to support AI agents that can participate in workflows. Not just answering questions, but helping triage incidents, suggest resolutions, create knowledge articles, generate runbooks, support fulfilment, and in some cases take constrained action across integrated systems (as well as evolving support for technologies like MCP and A2A).

I find our AI4 Capabilities Maturity Model useful here to explain the Service Desk evolution:

• Assist: AI helps individuals work faster. In the service desk, this means summaries, suggested replies, ticket search, and knowledge lookup.
• Augment: AI starts working with organisational data and service context. This is where it helps improve consistency across ticket handling, resolution notes, knowledge articles, and user communications.
• Advise: AI supports multi-step, human-in-the-loop work. Think triage, incident analysis, fulfilment guidance, and suggested next actions that still require judgement.
• Act: Agents begin performing delegated tasks. This is where the service desk connects to identity, asset records, monitoring tools, workflow engines, collaboration platforms, and approval processes.
• Automate: Routine work is fulfilled end to end with limited human intervention. This is the zero-touch service desk idea, but only for well-understood, well-governed use cases.

The service desk is not becoming fully autonomous overnight (both Gartner and Forrester suggesting this evolution is necessary but will take quite some time). The market appears much more mature for assistive AI than it is for autonomous execution. Most leading tools now have credible GenAI capabilities for summaries, drafting, triage, knowledge generation, and conversational self-service. The stronger platforms like ServiceNow, BMC Helix, Freshworks Freshservice, Zendesk, Atlassian JIRA are pushing into agentic workflows, AI agent studios, integration fabrics, and governed automation.

But the gap between “the AI can suggest something useful” and “the AI can safely do the work” is still significant and with AI changing the service desk from a ticket-handling function into a more active operational control point it makes judgement, review, accountability, and governance more important, not less.

What does it mean from a business perspective?

The value is not created by adding AI to the service desk tool. The value is created when AI improves real service work.

• Faster summaries are useful. Better knowledge search is useful. Draft replies are useful. But the real business value comes when the organisation can reduce friction in common workflows, improve first-contact resolution, shorten response times, increase consistency, and reuse knowledge more effectively.
• Effort savings and duration savings are different things. An analyst spending less time writing a response is an effort saving. A user getting access to the right software in 10 minutes instead of two days is a duration saving. Both matter, but they affect the organisation differently.
• The risk profile changes as AI moves closer to action. An assistant that drafts a response for review is one thing. An agent that updates a ticket, triggers an access workflow, changes a configuration record, sends a user communication, or closes an incident is another.
• ITIL 4 still matters. Incident management, service request management, knowledge management, change enablement, monitoring and event management, service configuration management, and the service desk practice all become more important as AI becomes embedded in operational work.
• Are the service management practices underneath it are strong enough for AI to rely on? Weak knowledge articles produce weak AI answers. Poor ticket hygiene produces poor triage. Inconsistent categorisation makes reporting unreliable. A messy CMDB limits automation. Unclear approval rules make agentic fulfilment risky.
• The same is true from a governance perspective. COBIT 2019 is useful here because it reminds us that technology delivery is not just about implementation. It is about benefits, risk, resources, quality, controls, monitoring, and accountability.

For service desk AI, it means asking practical questions. Who owns the AI-enabled workflow? What actions is the AI allowed to take? What requires approval? What evidence is retained? How are errors detected? How do we roll back? How do we know whether the service is actually improving?

Governance cannot sit only in policy documents, it has to show up in tool configuration, workflow design, knowledge management, access control, audit logging, vendor management, reporting, and the way people are trained to use the system.

What do I do with it?

The practical starting point is not to aim for a fully autonomous service desk, start with reality and use the AI4 maturity framework help you understand where you are (and if you are an ITL and COBIT shop, then map that onto your ITSM and COBIT maturity for a complete picture).

Overall - involve your Service Desk teams, they are closest to the customer and understand where they can optimise.

• Map where AI is already being used in service desk work. Analysts may already be summarising tickets, drafting replies, rewriting knowledge articles, or using general-purpose tools to interpret technical information. Understand what is happening before designing the future state.
• Separate assistance from action. Treat AI that helps people think, draft, summarise, or search differently from AI that performs tasks in systems. The management discipline to understand the risk and friction required should increase as the AI moves closer to operational action.
• Pick workflows where value and risk are understandable. Password resets, standard access requests, software provisioning, onboarding tasks, common knowledge queries, and routine service catalogue requests are usually better starting points than complex incidents or ambiguous business problems.
• Use ITIL practices as the operating frame. Do not create a separate “AI service desk model” if the existing service management model can be adapted. Look at the affected practices and ask what changes when AI becomes part of the workflow.
• Use COBIT-style governance questions to keep the work grounded. Who is accountable? What controls are needed? What risks are acceptable? How will performance be measured? What needs to be monitored? What happens when the AI is wrong? Review the principles, domains and objectives.

  A quick word on frameworks like ITIL and COBIT - your environments have a degree of uniqueness to them - take the frameworks and adapt them to your specific needs rather than blindly adopting them.

• Involve procurement and vendor management early. AI capability is increasingly bundled into platforms, premium tiers, add-ons, marketplaces, and agent studios. The commercial model, data usage terms (what will the vendor do with your data - use it for model training?), integration requirements, auditability, and exit options matter.
• Treat knowledge management as core infrastructure. If the knowledge base is weak, the AI will be weak. If ownership is unclear, content will decay. If articles are not written for reuse, both humans and AI will struggle.
• Measure operational value, not novelty. Useful measures might include faster triage, reduced backlog, better first-contact resolution, improved knowledge reuse, lower rework, shorter cycle times, better user satisfaction, and stronger compliance evidence.

Keep it lightweight at first, but make it real, the point here is not that IT should slow this down. Done well, the service desk is one of the best places to make AI adoption practical. It has real work, real demand, measurable outcomes, established processes, and clear pain points.

Ask yourself what kind of service desk the organisation is trying to build: A faster ticket desk? A better knowledge and support function? A more proactive operational service? Or, eventually, a governed automation layer that can resolve routine work before it becomes friction for the organisation?