Service Management System (SMS)

The overall management system used to direct and control service management activities. In ITIL 5 it includes direction and governance, value streams and practices, and enablers (people, information, technology, partners).

6C capability themes (purpose)

A high-level way to group related ITIL practices into six themes, helping organizations (and exam candidates) see how practices work together across customer value, control, change, people, design, and operations.

Customer and Co‑creation (theme focus)

Focuses on stakeholder value, outcomes, and experience. Includes practices like relationship management and service desk.

Control and Compliance (theme focus)

Focuses on governance, risk, and regulatory obligations. Critical for setting boundaries and controls around AI and automation.

Automation principle: simplify before you automate

Processes should be clarified and improved before automation is applied; otherwise, automation only makes flawed processes faster and harder to fix.

The use of technology to perform tasks with reduced or no human intervention. In ITIL 5 it must be aligned with value, risk, and control considerations.

What is Observability?

The ability to understand the internal state of a system based on the data it produces, such as logs, metrics, and traces, which is essential for safe automation and AI operations.

What is Human-in-the-loop?

A design approach where humans supervise, validate, or can override automated or AI‑driven decisions, especially for high‑risk scenarios.

What is Command and Control?

A capability theme focusing on day‑to‑day operations, monitoring, incident and event management, where many AI‑assisted tools are applied.

AI, Automation, and the 6C Capability Themes in ITIL Version 5 — ITIL Foundation (Version 5) Exam Prep Bootcamp

Q: An organization wants to introduce an AI-based monitoring tool that automatically creates incidents for critical alerts. Which capability theme is MOST focused on ensuring the tool’s alert rules and actions do not create unacceptable business risk?

Control and Compliance. **Control and Compliance** is most focused on governance, risk, and regulatory aspects. It ensures that automated actions (like AI‑created incidents or escalations) stay within acceptable risk levels and comply with policies. Command and Control runs the monitoring day to day, but risk appetite and controls sit in Control and Compliance.

Step 1: Where AI and Automation Fit in ITIL Version 5

Digital-era ITIL

ITIL Version 5 updates ITIL 4 for a digital and AI‑driven world. At Foundation level, you do not design AI models, but you must recognize where AI, automation, and data fit in the Service Management System.

What ITIL 5 Adds

ITIL 5 talks more explicitly about digital products, data, and AI‑assisted work. It treats automation as a deliberate design choice and highlights ethics, risk, and control for AI and advanced analytics.

Exam Angle

In the exam, AI and automation appear in conceptual questions, such as which capability theme or principle applies. You are not expected to know specific tools or build AI solutions.

Step 2: The ITIL 5 Service Management System and Where Tools Live

Service Management System Map

The ITIL 5 Service Management System has three big parts: direction and governance, value streams and practices, and enablers such as people, information, technology, and partners.

Where AI Fits

AI and automation mainly sit under the technology and information enablers. They support many practices but must still follow governance, risk, and compliance rules.

Exam Focus

Foundation questions test that you see automation as a supporting capability aligned with value, risk, and cost, not as a stand‑alone practice or goal in itself.

Step 3: The 6C Capability Themes – A High-Level View

What Are the 6Cs?

ITIL 5 groups practices into six capability themes: Customer and Co‑creation, Control and Compliance, Change and Continuity, Capabilities and Culture, Creation and Configuration, and Command and Control.

Themes in Plain Language

Customer and Co‑creation: value and experience. Control and Compliance: governance and risk. Change and Continuity: safe change and resilience. Capabilities and Culture: people and learning.

More Themes

Creation and Configuration: design, build, and configuration. Command and Control: day‑to‑day operations and monitoring. AI and automation touch all themes, but especially these last two plus Control and Compliance.

Step 4: Mapping AI and Automation to the 6Cs (Scenario Walkthrough)

Virtual Agent Scenario

A company introduces an AI‑assisted virtual agent on the service desk. Each of the 6Cs sees a different aspect of this change, from user journeys to risk, training, design, and operations.

Design, Risk, and People

Customer and Co‑creation shapes user journeys and experience. Control and Compliance ensures privacy and lawful use. Change and Continuity treats the rollout as a managed change with fallback options.

Build and Run

Creation and Configuration designs intents and integrations. Capabilities and Culture trains staff and manages attitudes. Command and Control monitors performance and keeps the AI knowledge up to date.

Step 5: Automation in ITIL 5 – Principles and Pitfalls

Automation Mindset

ITIL 5 continues the "optimize and automate" idea, but with more explicit focus on digital and AI. Automate to improve value, not just to use new technology.

Good Automation Practice

Simplify processes before automating. Keep humans in the loop for high‑impact decisions. Design for transparency so it is clear what is automated and why.

Recognizing Pitfalls

Pitfalls include assuming automation removes governance, treating AI as set‑and‑forget, and skipping training and change management. Exam answers usually balance value, risk, and control.

Step 6: Decide What to Automate (Thought Exercise)

You are advising a small IT team. They are considering three automation ideas:

Auto‑close incidents that have been in "resolved" status for 3 days without user response.
Auto‑approve all low‑risk changes without human review.
Use an AI model to suggest priority for incoming incidents based on past data.

For each idea, decide:

A. "Good candidate for automation with reasonable safeguards"
B. "Needs strong controls and human oversight"
C. "Risky or inappropriate as stated"

Write down your choices, then compare with the guide below.

Suggested answers and reasoning

Auto‑close incidents after 3 days

Suggested: A
Why: Common practice if users can easily reopen tickets. Risk is low if communication is clear.

Auto‑approve all low‑risk changes

Suggested: B
Why: Could work if "low‑risk" is well‑defined and periodically reviewed. Needs sampling, audits, and clear fallback.

AI‑suggested incident priority

Suggested: B
Why: Helpful as a recommendation, but humans should validate, especially early on, to avoid mis‑prioritization.

Notice how each decision links back to:

Value: Time saved, faster response
Risk and control: Oversight, definitions, and audit
Capability themes: Command and Control, Control and Compliance, Change and Continuity

Step 7: Quick Check – AI and the 6Cs

Test your understanding with a short question.

An organization wants to introduce an AI-based monitoring tool that automatically creates incidents for critical alerts. Which capability theme is MOST focused on ensuring the tool’s alert rules and actions do not create unacceptable business risk?

Customer and Co‑creation
Control and Compliance
Command and Control
Creation and Configuration

Show Answer

Answer: B) Control and Compliance

**Control and Compliance** is most focused on governance, risk, and regulatory aspects. It ensures that automated actions (like AI‑created incidents or escalations) stay within acceptable risk levels and comply with policies. Command and Control runs the monitoring day to day, but risk appetite and controls sit in Control and Compliance.

Step 8: Flashcard Review – Key Terms and Ideas

Use these flashcards to reinforce the most important ideas from this module.

Service Management System (SMS): The overall management system used to direct and control service management activities. In ITIL 5 it includes direction and governance, value streams and practices, and enablers (people, information, technology, partners).
6C capability themes (purpose): A high-level way to group related ITIL practices into six themes, helping organizations (and exam candidates) see how practices work together across customer value, control, change, people, design, and operations.
Customer and Co‑creation (theme focus): Focuses on stakeholder value, outcomes, and experience. Includes practices like relationship management and service desk.
Control and Compliance (theme focus): Focuses on governance, risk, and regulatory obligations. Critical for setting boundaries and controls around AI and automation.
Automation principle: simplify before you automate: Processes should be clarified and improved before automation is applied; otherwise, automation only makes flawed processes faster and harder to fix.
Human-in-the-loop: A design choice where humans review, approve, or can override automated or AI‑generated decisions, especially for high‑impact or high‑risk activities.
AI in Command and Control: AI can support monitoring, event correlation, and incident routing, but these activities still require observability, clear rules, and operational oversight.
Ethical and risk considerations for AI: Include data protection, bias, transparency, accountability, and the ability to explain and challenge AI‑driven decisions.

Key Terms

Automation: The use of technology to perform tasks with reduced or no human intervention. In ITIL 5 it must be aligned with value, risk, and control considerations.
Observability: The ability to understand the internal state of a system based on the data it produces, such as logs, metrics, and traces, which is essential for safe automation and AI operations.
Human-in-the-loop: A design approach where humans supervise, validate, or can override automated or AI‑driven decisions, especially for high‑risk scenarios.
Command and Control: A capability theme focusing on day‑to‑day operations, monitoring, incident and event management, where many AI‑assisted tools are applied.
6C capability themes: A grouping of ITIL 5 practices into six high-level capability areas: Customer and Co‑creation, Control and Compliance, Change and Continuity, Capabilities and Culture, Creation and Configuration, and Command and Control.
Change and Continuity: A capability theme focused on enabling safe change and ensuring resilience and continuity of services.
Control and Compliance: A capability theme focusing on governance, risk management, security, and regulatory compliance, especially important for AI and data‑intensive services.
Capabilities and Culture: A capability theme dealing with people, skills, behaviors, and organizational culture needed to support digital and AI‑enabled services.
Creation and Configuration: A capability theme covering design, architecture, development, and configuration of services, including how automation and AI are built into them.
Customer and Co‑creation: A capability theme focusing on stakeholder value, outcomes, and experiences, emphasizing collaboration between provider and consumers.
AI (Artificial Intelligence): A broad set of techniques where systems perform tasks that normally require human intelligence, such as pattern recognition, language understanding, or decision support.
Service Management System (SMS): The management system used to direct and control service management activities, including governance, value streams, practices, and enabling resources.