Imagine your VPN stops working tomorrow.
In most organisations, the process still starts with you. You notice the problem, open a portal, describe what is wrong and create a ticket. Someone reads it, may ask for more information, checks the logs and looks for a solution.
We are so used to that workflow that it feels almost inevitable.
But it contains a strange assumption: the user has to notice the problem before IT can start doing something about it.
That is where the next few years could become genuinely different.
AI in IT support will probably do more than help teams close tickets faster. It may mean that some issues never need to be reported by a user in the first place.
The market is already looking beyond a chatbot on the ticket form
AI in IT Service Management is no longer treated as a small add-on. Gartner now has a dedicated market category for AI Applications in IT Service Management.
Its August 2026 research covers products that use AI for end-user self-service, guidance for IT agents and autonomous ITSM actions.
That matters because the question is no longer simply whether AI can draft an answer. The market is moving towards a broader issue: which parts of incident, request, problem and change management can software prepare or execute by itself?
Most organisations are still in the earlier stage. AI summarises tickets, suggests categories, searches knowledge articles and drafts responses. That saves time, but the underlying operating model remains largely intact.
A user reports something. A ticket is created. Someone processes it.
That is faster than before, but it is not yet a fundamentally different support model.
The next step starts before the ticket exists
Take the VPN issue again.
Suppose monitoring detects failed connections on its own. An agent checks endpoint status, recent changes and logs. It notices that the same pattern has already appeared on several devices that morning and matches a known problem.
There is a pre-approved, low-risk remediation available. The agent runs it, verifies that the connection has recovered and records what happened.
For the user, the entire experience might be one notification:
We detected a connection issue and restored the service.
No portal. No queue. No email exchange.
Perhaps no visible interruption at all.
That is much more interesting than a chatbot that helps someone fill in a ticket faster.
The ticket will not disappear completely. Its role may change.
There is an important nuance here.
A mature IT environment still needs to know that something happened. Audit, reporting, problem management, compliance and trend analysis do not disappear simply because an agent resolved the issue on its own.
An ITSM record may therefore still be created.
It just does not have to play the same role it plays today.
Today, a ticket is often three things at once: the user's report, the work item for IT and the administrative record afterwards. In a more autonomous environment, it may increasingly become a traceable record of an event and the action taken.
The ticket as a system record remains useful. The ticket as a queue for distributing manual work can become much less central.
That distinction matters.
The best support interaction is sometimes the one that never had to happen
Service desks understandably track familiar KPIs: ticket volumes, first contact resolution, resolution time, backlog and SLA compliance.
But imagine that next year an environment generates 30 percent fewer tickets because issues are detected earlier, repaired automatically or prevented through better problem management.
Has the service desk become less productive?
Of course not.
It may have had its best year yet.
That is why another question becomes more useful than "How quickly do we close tickets?":
How much disruption do users still experience?
That moves service management closer to the business. Not how many records were processed, but how much working time was lost, how often incidents returned and how many problems were avoided altogether.
Early evidence points in that direction
In October 2026, ServiceNow published research based on 285 IT executives at large organisations. Help desk was the area where respondents reported the strongest positive AI impact, at 53 percent.
The same study also shows how early true autonomy still is. Thirty-nine percent are exploring or piloting agents and another 39 percent use them mainly to assist employees. Only 5 percent say they have genuinely redesigned jobs, workflows and controls for autonomous execution.
This is vendor-sponsored research and should be read in that context. The pattern is still useful: AI is being added faster than operating models are being redesigned.
That is visible in many IT environments. A smart layer is added on top of a process designed ten years ago. It helps, but it is probably not where the biggest gains will come from.
L1 support will change first
A large part of traditional first-line support is predictable work. That is where automation can make the fastest difference.
Good candidates for automation
- Password resets and account unlocks.
- Standard software, simple access requests, known errors and low-risk remediation.
Where human judgement still matters
- Incidents that span several systems or do not have a clear cause.
- Time-critical user problems, poorly documented exceptions and higher-impact decisions.
That does not mean L1 support disappears. It means people spend less time on actions that happen hundreds of times a month in almost the same way.
What remains is the work that needs more experience, communication and judgement.
Lower volume may make the human role more valuable
If AI and automation handle the predictable work, the service desk will see a higher share of complex situations.
That can shift the job away from ticket processing and towards service monitoring, major incidents, problem management, user experience, knowledge improvement and continuous improvement.
The service desk becomes less of a front counter and more of a control room.
Not just reacting to what arrives, but constantly looking for friction and for disruptions that can be prevented.
That is actually much closer to what good Service Delivery has always tried to achieve.
Who supports the support agent?
More autonomy also creates a new problem.
An agent can be wrong.
Imagine it misreads an incident, runs a remediation and sees that the problem is still there. It automatically tries a second action. Then a third.
Before anyone notices, the system has made several changes while trying to solve one issue.
The service desk may be automated, but the automation itself has become a source of incidents.
That is why familiar principles such as least privilege, logging, rollback and change control remain relevant. Perhaps more relevant than before.
A person often makes the same mistake once. An agent can repeat it very quickly and at scale.
Not every automated action needs human approval
There is a trap on the other side too.
If every step an agent takes must be manually approved, much of the benefit disappears. You have simply built a faster system that still waits for the same human click.
A password reset under clearly defined conditions may be safe to automate. The same may be true for approved software or a known low-risk remediation. A production change, privilege escalation or firewall change belongs in a different category.
That is why we prefer three clear levels instead of talking about "full autonomy" without context:
- Assist: AI finds information, analyses the issue and suggests what to do. A person performs the action.
- Advise: AI prepares a concrete action and shows the evidence, impact and recovery path. A person decides.
- Act: AI performs pre-approved low-risk actions on its own within clear boundaries. If something falls outside those boundaries, it stops.
The future is therefore not really about human or AI. It is about deciding how much autonomy is appropriate for each action.
That is less dramatic than a fully autonomous service desk, but far more credible operationally.
SLAs will need to evolve too
Many service contracts still focus heavily on response and resolution times. That remains useful when a user reports an incident and someone then needs to respond.
But what does response time mean when a system detects the issue itself?
And how useful is a fast resolution time if the same problem returns every week?
In a more automated environment, other measures become more important: actual disruption minutes, recurrence rate, incidents prevented proactively, success rates for automated actions and recovery time when automation fails.
That does not make SLAs obsolete. It may finally move them closer to the user's actual experience.
A report full of green boxes is not worth much if people still cannot get their work done.
The service desk probably is not disappearing
But the reason it exists may change.
Today, the service desk is often where problems arrive and get distributed.
Tomorrow, it may be the place where human expertise, automation and monitoring come together.
AI handles repetitive work. People handle context and exceptions. Service managers look beyond volume towards recurring disruption, risk and experience.
And the ticket?
It will probably remain useful as evidence, data and an audit trail. It simply does not need to be the start of a manual queue for every issue.
Perhaps the most interesting KPI for the service desk of the future will not be how many tickets it closes.
It may be how many tickets nobody ever needed to open.
Sources and further reading
- Gartner, Magic Quadrant for AI Applications in IT Service Management (17 August 2026): https://www.gartner.com/en/documents/8270821
- Gartner, Critical Capabilities for AI Applications in IT Service Management (17 August 2026): https://www.gartner.com/en/documents/8272821
- ServiceNow, The New CIO Mandate / research release (5 October 2026): https://newsroom.servicenow.com/press-releases/details/2026/Report-CIOs-have-the-AI-mandate-and-the-budget-but-few-organizations-are-well-positioned-for-true-autonomous-work/default.aspx

