What IT Teams Automate With AI First, and What Still Needs a Human

Most IT teams do not need a bold plan for AI. They need a short list of boring, repeated jobs where a tool can read, summarise or draft, plus a clear rule for the jobs where a person must stay in charge. This guide sets out a simple three-level model, a few good first candidates, the jobs to leave alone for now, and a 30-day starter plan. Updated 7 November 2026.

What the surveys say, and how much to trust them

Treat the figures below as context, not proof. Each one is vendor research, a secondary write-up, or older than this post, and none of them measures your team.

• An IBM survey from January 2024, as summarised by Constellation Research, listed the top AI use cases as IT process automation (33%), security and threat detection (26%) and AI monitoring and governance (25%). This is a vendor survey, reported second-hand, and it is almost two years old.
• A Riverbed survey, reported in an ITWire guest article, found that 90% of respondents plan to pursue autonomous IT operations, yet 77% require human approval. Again a vendor survey, passed on by a guest article.
• We have only seen Gartner's 2026 Hype Cycle for AI in IT service management through a third-party PDF, so this is second-hand. As we read it, it suggests starting with high-volume alert streams, warns that some automation is still immature, and names ticket triage, summaries and drafted replies as core features.
• Gartner has also forecast that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from under 5% in 2025. That is a general forecast about enterprise software, not about IT teams.

The pattern is useful even if the numbers are rough: people want to automate IT work, and most still want a human to approve it.

A three-level model

Rather than asking "should we automate this?", ask "how far should we automate this?"

Level A: report only. A tool reads data and produces a report or summary. A person decides and acts. Nothing changes without a human.

Level B: draft, then approve. A tool drafts the reply, the script or the change. A person reviews it and approves it before anything happens.

Level C: unattended, only when low risk. Only consider this when the risk of getting it wrong is low, the steps are clear and repeatable, no sensitive data is involved and no approval is needed. Even then, test it first, log every run and keep a way to switch it off.

High-risk work and anything that touches sensitive data never goes to level C. A task with unclear steps starts at level A, because you cannot safely automate what you cannot describe.

Good first candidates

These are mostly level A or B. They read, summarise or draft, and a person stays in the loop.

1. Licence reclaim reports. Microsoft 365 admin guidance from vendors such as CoreView and Rencore lists reclaiming unused licences as a standard theme. Start with a report of candidates. Our licence waste analyzer works on a CSV in your browser.
2. Stale account reports. A weekly list of accounts with no recent sign-in is a reading job. Someone reviews it before anything is disabled.
3. Certificate expiry. A dated list of what expires and who owns it. See the certificate expiry planner.
4. Ticket summaries and drafted replies. This matches the ticket triage, summary and drafted-reply features the Gartner material, as we saw it second-hand, calls core. A person sends the reply.
5. Audit evidence. The same vendor themes include automated audit evidence. Collecting screenshots, exports and logs into a folder is a reading and filing job.
6. Cost anomaly summaries. The same themes include controlling AI and consumption spend. A short weekly note on what jumped is easier to act on than a raw bill.

What not to automate yet

• Access grants. Who gets access to what is a decision, not a chore. Let a tool prepare the request and a person approve it.
• Deletions. Deleting accounts, mailboxes, files or resources is hard to undo. Report first.
• Anything touching sensitive data without approval. Check what a tool is allowed to see before you point it at personal, financial or customer data.
• AI agents with no named owner. The vendor themes above include governing who owns each AI agent and preventing data loss through prompts. Our AI agent governance checklist covers ownership, permissions and audit visibility.

Scripts deserve a look too. If a tool writes PowerShell for you, run it through the PowerShell script risk reviewer and read it yourself before it runs.

A 30-day starter plan

Days 1 to 7: list the work. Write down every recurring task, how often it runs, how long it takes, how many people do it, the risk if it goes wrong, whether it touches sensitive data, whether it needs approval and whether the steps are clear. Our IT automation priority planner turns that list into hours and a ranking in your browser.

Days 8 to 14: pick two. Choose one level A job and one level B job from the top of the ranking. Prefer high-volume, low-risk work.

Days 15 to 24: build and test. Run the level A report alongside the manual process and compare. Run the level B draft and count how often a person has to change it.

Days 25 to 30: review. Keep what saved time, drop what did not, and write down who owns each automation. Only then consider whether anything deserves a trial at level C.

Limits

Hours in the planner are an estimate from your own inputs. They are not a promised saving, because building, checking and maintaining automation takes time as well. The survey figures above are from vendors and secondary sources, and some are older.

Next steps

Try the IT automation priority planner. If you would like read-only help reviewing a Microsoft 365 environment, see OpsPilot, or request a service session.