6 Apr 2026

The Kyndryl announcement is being framed as an ITSM story, but for anyone running regulated financial services technology, it is really a controls story.

The shift from ticket-based IT operations to AI-driven autonomous workflows sounds appealing. Faster resolution times, less manual triage, reduced overnight incident burden. In a consumer credit operation where loan origination platforms run continuously and downtime directly affects customers trying to access credit, that operational efficiency matters.

But here is what the framing consistently undersells: autonomous agents making decisions inside your IT estate are doing so without a human in the loop. In a regulated environment, that distinction is not academic. The FCA expects firms to demonstrate accountability for decisions that affect customers. When an agentic system deprioritises a customer-facing incident, reroutes a process, or makes a change to a production configuration, who owns that decision? How is it logged? How do you evidence it to a regulator?

The Kyndryl model references governance and controls as prerequisites, which is the right instinct. The problem is that most enterprise IT teams are not starting from a position where their current ITSM governance is clean. They carry years of process debt, undocumented workflows, and change controls that exist on paper more than in practice.

Dropping an agentic layer on top of that does not fix the underlying governance gaps. It accelerates through them.

For technology leaders in UK consumer finance, the sensible position is:

• Treat agentic ITSM as a destination that requires documented, auditable current-state processes before you can automate them responsibly
• Build your governance model before you build your automation model, not alongside it

The firms that will get real value from autonomous IT operations are the ones that have already done the unglamorous work of mapping their change controls, incident classifications, and accountability chains properly.

The question worth sitting with: if you could not fully evidence your current IT decision-making to a regulator today, what makes you confident that automating it makes that problem better rather than faster?