KING TECHNOLOGYSolutions Group

Research · Service management

ITSM in 2028

Published October 2026 · Sources checked October 18, 2026

1. The question about the future

By 2028, as AI agents handle a growing share of first-line IT work, what becomes of the ticket, the configuration management database (CMDB), change approval, problem management and the human service desk, and what should organizations put in place now so the shift is safe and worth it?

This piece is about service management practice, not any product. The question is not whether agents arrive; public surveys show they already have in assistive form. It is about what happens to the core records and controls of IT service management once software, not people, carries out much of the routine work.

2. The signals today

2.1 Adoption: widespread assistance, limited autonomy

  • A 2026 practitioner survey. ITSM.tools surveyed 256 IT service management professionals in Q2 2026 (published June 8, 2026). Nearly 75% said their organizations use their ITSM tools' AI capabilities to some extent. Use was still mostly assistive: 15% reported partially autonomous use in limited processes and 6% largely autonomous use across multiple processes. The top agentic use cases were autonomous incident triage and resolution (18%), autonomous knowledge creation and improvement (18%) and end-to-end automated request fulfillment (13%). The top barriers were poor data quality (32%), risk, governance or compliance concerns about autonomous actions (30%), and a lack of internal skills (24%). Half of organizations planned to move from assistive to agentic AI within 12 months. [S1]
  • Analyst expectations, with caveats. Gartner predicted on March 5, 2025 that by 2029 agentic AI will autonomously resolve 80% of common customer service issues without human intervention, linked to a 30% reduction in operational costs. [S2] That prediction concerns customer service broadly, not IT service desks specifically, and the release does not explain how the figures were derived. Three months later, on June 25, 2025, Gartner predicted that over 40% of agentic AI projects will be canceled by the end of 2027 because of rising costs, unclear business value and inadequate risk controls. The same release warned of "agent washing" (existing assistants, robotic process automation and chatbots rebranded as agents) and forecast that by 2028 at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from 0% in 2024. [S3]

Taken together, the signals point to fast-growing interest, mostly assistive use today, and real risk of projects stalling where data and controls are weak.

2.2 Practice guidance is moving the same way

  • ITIL 4 change enablement. ITIL 4 renamed change management "change enablement" and framed it around facilitating safe change rather than gatekeeping. It keeps three change types (standard, normal and emergency) and introduces a "change authority" that can be a delegated team, peer review or automated approval in delivery pipelines, depending on risk. A 2026 practitioner summary notes that a common misreading of earlier ITIL guidance, that every change had to go to a change advisory board (CAB), is corrected in ITIL 4. [S4]
  • Research on change approval. The DORA research program reports, citing its 2019 State of DevOps research, that approval by an external body such as a CAB or senior manager was associated with lower software delivery performance, and that "no evidence was found to support the hypothesis" that formal external review lowers change fail rates. It recommends peer review, automated testing and monitoring, and repositioning the CAB as a coordinator of business trade-offs. It suggests measuring the percentage of changes needing no manual approval, by risk level, and the time changes wait for approval. [S5]
  • ITIL Version 5. PeopleCert, which publishes ITIL, has rolled out ITIL (Version 5) in phases during 2026. Training-provider summaries describe it as building on ITIL 4, keeping all 34 management practices and adding a product and service lifecycle view. PeopleCert has said AI Governance is being introduced as an extension module, and ITIL 4 is expected to run in parallel for at least 12 months. [S6][S7] We could not confirm an exact release date against a PeopleCert page.

2.3 Governance frameworks and regulation

  • NIST AI RMF. NIST's voluntary AI Risk Management Framework (released January 26, 2023) organizes AI risk work into four functions: govern, map, measure and manage. [S8] Its FAQ (updated August 13, 2026) lists the characteristics of trustworthy AI, including valid and reliable, safe, secure and resilient, accountable and transparent, and explainable and interpretable. It notes that the July 2025 AI Action Plan tasked NIST with revising the framework. [S9] The Generative AI Profile (NIST AI 600-1, July 26, 2024) extends it to generative systems. [S10]
  • ISO/IEC 42001:2023. Published December 18, 2023, this standard specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, using a plan-do-check-act approach, for organizations of any size that develop, provide or use AI. [S11]
  • EU AI Act timelines. For organizations with EU operations or EU-based staff, the "Digital Omnibus" amendment (Regulation (EU) 2026/1744) entered into force on July 27, 2026. It moved the main obligations for stand-alone high-risk systems in Annex III to December 2, 2027, and for AI embedded in regulated products (Annex I) to August 2, 2028. Transparency obligations apply from August 2, 2026. [S12][S13] Annex III includes employment and workers' management. Draft European Commission guidelines published May 19, 2026, as summarized by one law firm, treat task allocation based on behavioral indicators (such as acceptance rates or ratings) as high-risk, and say monitoring that systematically evaluates workers is likely high-risk. [S14] That is relevant to service desks if an AI system allocates tickets to human staff based on their performance scores, or evaluates analysts. It is a question for legal counsel, not a conclusion.
  • Telemetry for agents. OpenTelemetry's documentation now includes semantic conventions for generative-AI and agent activity, maintained in a dedicated repository. That gives organizations a standard way to trace what an agent did and when. [S15]

2.4 What the signals imply, piece by piece

The scenarios in Section 3 differ in pace. The direction of change for each part of service management is similar across all of them.

The ticket: from work request to evidence record. Today a ticket is mainly a queue item that tells a person what to do. When an agent resolves a password reset or a software request end to end, the ticket's main job becomes recording what was asked, what the agent decided, what it changed, what it checked and who could have stopped it. That is the "accountable and transparent" property NIST lists. [S9] Some interactions may never look like a ticket to the requester, but the record still matters for audit, cost reporting and improvement.

The CMDB: from inventory to the agent's map of consequences. An agent that restarts a service, changes a group membership or re-images a laptop needs to know what depends on that item. Data quality was the most-cited barrier to agentic AI in the 2026 survey. [S1] In an agent-assisted desk, a stale relationship in the CMDB is no longer just a reporting problem; it can lead an agent to act on the wrong thing.

Change approval: the standard-change catalog becomes the agent's permission list. Under ITIL 4, standard changes are pre-authorized, low-risk and repeatable. [S4] An agent's safe operating area can be defined the same way: an explicit catalog of actions it may take without further approval, with conditions and rollback steps. Anything outside the catalog becomes a normal change routed to the right change authority. DORA's research supports keeping human review for genuine business trade-offs rather than routine low-risk changes. [S5]

Problem management: machines cluster, people decide. Agents and learning systems are good at noticing that 40 incidents share a pattern (Illustrative figure). Deciding whether to fix the underlying cause, accept the risk or redesign a service involves cost, priorities and ownership, which remain human judgments. Problem records may be proposed automatically more often, with people spending more of their time on analysis and decisions.

The service desk: from first-line resolver to supervisor, coach and exception-handler. If routine requests move to agents, human analysts handle the complex, sensitive and ambiguous ones, review agent decisions, curate the knowledge agents rely on, and manage escalations. The skills gap the 2026 survey reports (24%) suggests that this transition needs planned training. [S1]

3. Plausible outcomes by 2028

These are scenarios, not predictions.

Scenario A: The assistive plateau. Agents draft replies, summarize tickets, suggest knowledge articles and pre-fill forms, but people still approve almost every action. Autonomous use stays a small share, similar to the 6% "largely autonomous" figure in 2026. [S1]

Signals that would tip toward A: high project cancellation, as Gartner anticipates for agentic AI broadly [S3]; persistent data-quality problems; unresolved governance concerns; regulatory uncertainty for EU operations as December 2027 approaches. [S12]

Scenario B: Bounded autonomy. Agents resolve a defined set of high-volume requests and low-risk incidents end to end, inside an explicit standard-change catalog, with full logging. People handle everything else and review samples of agent work. The ticket becomes primarily an audit record for agent work.

Signals that would tip toward B: organizations measuring and expanding pre-approved change categories [S5]; adoption of ITIL Version 5's AI Governance module or ISO/IEC 42001 management systems [S6][S11]; agent telemetry conventions maturing so that actions are traceable. [S15]

Scenario C: Agent-first operations. Agents handle most first-line interactions and many incident, request and change workflows across systems, coordinating with each other. Human teams act as supervisors, owners of policy, and specialists for complex work.

Signals that would tip toward C: published evidence that autonomous resolution rates hold up under audit; a revised NIST AI RMF giving concrete guidance on autonomous actions [S9]; clear regulatory guidance on task allocation and worker monitoring [S14]; CMDB accuracy high enough for agents to act on.

Many organizations may sit in different scenarios for different services at once: bounded autonomy for workplace requests, the assistive plateau for infrastructure changes.

4. What to do now

Each step below pays off in all three scenarios.

For IT operations and service management teams

  • Build the standard-change catalog as if an agent will use it. For each pre-approved change, document conditions, required checks, the rollback step and how success is verified. That catalog serves human analysts today and agents later. [S4][S5]
  • Measure approval flow. Track the share of changes needing no manual approval by risk level, and approval wait times, as DORA suggests. [S5]
  • Target CMDB accuracy where action happens. Prioritize relationships for the services and items most often touched by routine requests and incidents, rather than trying to perfect everything. [S1]
  • Define what a ticket must record when software acts. Agree on minimum fields: the request, the data used, the action taken, the result, any human reviewer, and a link to the trace. [S9][S15]
  • Turn resolved incidents into knowledge on purpose. Well-maintained knowledge articles improve both human and agent resolution, and autonomous knowledge creation was a top use case in 2026. [S1]
  • Plan skills, not just tools. Train analysts in supervising, reviewing and escalating agent work. [S1]

For CIOs and CFOs

  • Fund data quality and governance alongside agent features. These were the top two barriers in 2026 and two of the three reasons Gartner gives for agentic project cancellations. [S1][S3]
  • Ask for evidence, not labels. Given the "agent washing" warning, ask vendors to demonstrate end-to-end resolution on your own request types, with logs, before committing. [S3]
  • Set value measures before pilots. Agree on baseline measures (volume, resolution time, reopen rate, satisfaction, cost per resolution) so results can be compared honestly.
  • Choose a governance anchor. NIST AI RMF, ISO/IEC 42001 and ITIL's AI Governance module overlap; pick one as the primary reference and map the others to it. [S6][S8][S11]
  • Check EU exposure. If you have EU operations or staff, ask counsel whether any planned use (for example, AI-based ticket assignment to staff, or analyst performance scoring) could fall under Annex III ahead of December 2, 2027. [S12][S14]

For public-sector buyers

  • Write auditability into solicitations. Require that every automated action be logged with the information needed for later review, and that logs be exportable in open formats. [S9][S15]
  • Require a defined, editable permission scope. Agencies should be able to see and change exactly which actions an agent may take without approval. [S4]
  • Reference recognized frameworks. Citing NIST AI RMF and the Generative AI Profile gives vendors a shared baseline for responses. [S8][S10]
  • Plan for records retention. Confirm how agent-generated tickets, transcripts and summaries will be retained under the records rules that apply to your agency.
  • Keep a human path open. Make sure residents and employees can always reach a person, and that this route is easy to find.

Drafted with AI assistance; sources checked and interpreted by King Tech.

Planning for this in your organization?

King Tech collaborates on custom solution architecture: we work alongside your team to design an approach that fits your systems, your constraints and your timeline. Contact King Tech to start the conversation.

Book a consultation Ask a question

Sources