ITIL 4 CAI cheat sheet

AI in service management covers machine learning, natural language processing, generative AI, and rule-based automation applied to service design, delivery, support, and improvement.

Four common AI use patterns in ITSM: classification and triage, prediction (volume, breach risk, root cause), generation (summaries, drafts, code), and conversational assistance (chatbots, agent copilots).

AI augments the four dimensions of service management (organizations and people, information and technology, partners and suppliers, value streams and processes); it does not replace any dimension.

Decision rule: use AI where the task is high-volume, pattern-based, and tolerant of probabilistic error; keep deterministic, regulated, or low-volume high-stakes tasks under human control.

Utility is what the service does (fit for purpose); warranty is how well it does it (fit for use). For AI services, warranty must additionally cover accuracy, reliability, and security of outputs.

A model is a statistical artifact trained on historical data; it inherits bias and gaps from that data, so output quality is bounded by training-data quality and representativeness.

Classification vs generation: classifiers output labels from a fixed set (used for routing, prioritization); generative models produce free text or artifacts and require verification before use.

AI shifts the service desk from transactional handling toward exception handling, verification, and relationship work; volume metrics alone become misleading indicators of value.

Governance defines decision rights and accountability for AI: who approves a use case, who owns the model in production, who accepts residual risk, and who can suspend the system.

Model ownership must be named per use case; 'the AI team' is not an accountable owner. Accountability stays with a human role even when the model acts autonomously.

Core risk categories: bias and unfairness, hallucination and factual error, privacy and data leakage, security (prompt injection, data poisoning), drift, over-reliance, and opacity.

Human-in-the-loop decision rule: mandatory where outputs affect safety, legal rights, employment, credit, or access to essential services; optional where outputs are low-impact and reversible.

Model risk tiering: classify use cases by impact and reversibility (low, medium, high). Higher tiers require stronger validation, monitoring frequency, and approval authority.

Monitoring covers data drift (input distribution change), concept drift (input-output relationship change), performance decay, and safety incidents; thresholds and owners are defined in advance.

Registers to maintain: AI use-case inventory, model register (version, owner, training data lineage, approval date), and incident log for AI-caused failures.

Third-party and foundation-model risk: contracts must address data use for training, output ownership, model change notification, deprecation timelines, and audit rights.

The service value chain has six activities: plan, improve, engage, design and transition, obtain/build, and deliver and support. AI can be embedded in each, but accountability remains with the practice owner.

Incident management: AI supports classification, similarity-based matching to known errors, summarization of long threads, and suggested resolution; the human confirms severity and closure.

Problem management: AI accelerates pattern detection across incidents and log correlation; causal validation and known-error acceptance remain human decisions.

Change enablement: AI can assess risk from historical change-failure data and draft change records; the change authority remains accountable for authorization.

Service desk and request management: chatbots handle high-volume, low-complexity requests; escalation rules must define when the bot hands off to a human and pass context with it.

Knowledge management: generative AI drafts articles from resolved tickets, but every article requires human review before publication to prevent error propagation.

Continual improvement: AI surfaces trends and anomalies; the improvement register, prioritization, and benefit realization are governed by humans using the value-chain 'improve' activity.

Measurement: track both outcome metrics (first-contact resolution, mean time to restore) and AI-specific metrics (suggestion acceptance rate, escalation rate, override rate, error rate).

Trust in AI rests on four observable properties: transparency (how it works), explainability (why this output), controllability (how to intervene), and reliability (consistent performance).

Ethical principles commonly applied: fairness, accountability, transparency, human oversight, privacy, safety, and sustainability. Each needs an operational control, not just a statement.

Explainability decision rule: the higher the impact of the decision, the stronger the explanation owed to the affected person; black-box outputs are unacceptable for adverse high-impact decisions.

Bias testing requires disaggregated evaluation across affected groups; aggregate accuracy can hide subgroup failure. Set acceptance thresholds before testing.

Feedback loops are a distinct risk: AI trained on its own outputs can amplify errors and narrow diversity. Keep human-generated data in the training pipeline.

Continual improvement with AI follows the Deming cycle: plan (use case and success criteria), do (pilot), check (measure against baseline and thresholds), act (scale, adjust, or retire).

Retirement criterion: define in advance the performance floor below which a model is suspended; without it, degraded models persist because no one owns the decision to stop.

Transparency to users: disclose when a person is interacting with an AI system and provide a route to human review, especially for complaints and adverse outcomes.

AI in service management covers machine learning, natural language processing, generative AI, and rule-based automation applied to service design, delivery, support, and improvement.

Four common AI use patterns in ITSM: classification and triage, prediction (volume, breach risk, root cause), generation (summaries, drafts, code), and conversational assistance (chatbots, agent copilots).

AI augments the four dimensions of service management (organizations and people, information and technology, partners and suppliers, value streams and processes); it does not replace any dimension.

Decision rule: use AI where the task is high-volume, pattern-based, and tolerant of probabilistic error; keep deterministic, regulated, or low-volume high-stakes tasks under human control.

Utility is what the service does (fit for purpose); warranty is how well it does it (fit for use). For AI services, warranty must additionally cover accuracy, reliability, and security of outputs.

A model is a statistical artifact trained on historical data; it inherits bias and gaps from that data, so output quality is bounded by training-data quality and representativeness.

Classification vs generation: classifiers output labels from a fixed set (used for routing, prioritization); generative models produce free text or artifacts and require verification before use.

AI shifts the service desk from transactional handling toward exception handling, verification, and relationship work; volume metrics alone become misleading indicators of value.

Governance defines decision rights and accountability for AI: who approves a use case, who owns the model in production, who accepts residual risk, and who can suspend the system.

Model ownership must be named per use case; 'the AI team' is not an accountable owner. Accountability stays with a human role even when the model acts autonomously.

Core risk categories: bias and unfairness, hallucination and factual error, privacy and data leakage, security (prompt injection, data poisoning), drift, over-reliance, and opacity.

Human-in-the-loop decision rule: mandatory where outputs affect safety, legal rights, employment, credit, or access to essential services; optional where outputs are low-impact and reversible.

Model risk tiering: classify use cases by impact and reversibility (low, medium, high). Higher tiers require stronger validation, monitoring frequency, and approval authority.

Monitoring covers data drift (input distribution change), concept drift (input-output relationship change), performance decay, and safety incidents; thresholds and owners are defined in advance.

Registers to maintain: AI use-case inventory, model register (version, owner, training data lineage, approval date), and incident log for AI-caused failures.

Third-party and foundation-model risk: contracts must address data use for training, output ownership, model change notification, deprecation timelines, and audit rights.

The service value chain has six activities: plan, improve, engage, design and transition, obtain/build, and deliver and support. AI can be embedded in each, but accountability remains with the practice owner.

Incident management: AI supports classification, similarity-based matching to known errors, summarization of long threads, and suggested resolution; the human confirms severity and closure.

Problem management: AI accelerates pattern detection across incidents and log correlation; causal validation and known-error acceptance remain human decisions.

Change enablement: AI can assess risk from historical change-failure data and draft change records; the change authority remains accountable for authorization.

Service desk and request management: chatbots handle high-volume, low-complexity requests; escalation rules must define when the bot hands off to a human and pass context with it.

Knowledge management: generative AI drafts articles from resolved tickets, but every article requires human review before publication to prevent error propagation.

Continual improvement: AI surfaces trends and anomalies; the improvement register, prioritization, and benefit realization are governed by humans using the value-chain 'improve' activity.

Measurement: track both outcome metrics (first-contact resolution, mean time to restore) and AI-specific metrics (suggestion acceptance rate, escalation rate, override rate, error rate).

Trust in AI rests on four observable properties: transparency (how it works), explainability (why this output), controllability (how to intervene), and reliability (consistent performance).

Ethical principles commonly applied: fairness, accountability, transparency, human oversight, privacy, safety, and sustainability. Each needs an operational control, not just a statement.

Explainability decision rule: the higher the impact of the decision, the stronger the explanation owed to the affected person; black-box outputs are unacceptable for adverse high-impact decisions.

Bias testing requires disaggregated evaluation across affected groups; aggregate accuracy can hide subgroup failure. Set acceptance thresholds before testing.

Feedback loops are a distinct risk: AI trained on its own outputs can amplify errors and narrow diversity. Keep human-generated data in the training pipeline.

Continual improvement with AI follows the Deming cycle: plan (use case and success criteria), do (pilot), check (measure against baseline and thresholds), act (scale, adjust, or retire).

Retirement criterion: define in advance the performance floor below which a model is suspended; without it, degraded models persist because no one owns the decision to stop.

Transparency to users: disclose when a person is interacting with an AI system and provide a route to human review, especially for complaints and adverse outcomes.