By Christian Siegers, Principal, KPMG Advisory, Technology, AI & Data
In conversations with platform teams, architects and operational leaders, I increasingly notice that the discussion is no longer about observability itself. Most organizations already understand the need for observability. The real question is becoming how much operational decision-making they are willing to delegate to AI.
A few years ago, most discussions focused on reducing alert fatigue, improving incident response and understanding what was happening inside increasingly complex environments. Today, observability is increasingly becoming the foundation rather than the objective. The question is no longer whether systems can detect issues. The question is whether systems should be allowed to resolve them autonomously.
At first glance, this appears to be a natural evolution. Modern technology landscapes have become too complex for humans alone to manage efficiently. Cloud-native architectures generate vast amounts of telemetry, systems are increasingly distributed, and operational teams are expected to maintain reliability across growing estates without proportional increases in staffing. In many organizations, the volume of operational signals has already exceeded what humans can realistically process.
This is precisely where AIOps creates value. By applying machine learning and automation to operational data, organizations can reduce noise, identify patterns and accelerate decision-making.
Yet while the industry is largely focused on how AI can improve operations, I believe a more interesting question is emerging: What happens when AI becomes part of the resilience strategy itself? Every step towards operational autonomy reduces one category of risk while potentially introducing another.
From observation to action
Most organizations do not operate at a single level of AIOps maturity. What I frequently observe is that different parts of the organization move at different speeds. Platform teams often embrace automation and predictive capabilities early, while business-critical applications continue to rely on manual intervention, traditional operational procedures and human decision-making.
Despite these differences, most organizations follow a broadly similar journey. What I find interesting is that every step in this maturity journey reduces the need for human intervention while simultaneously increasing the consequences of a wrong decision.
In the early stages, AI primarily helps humans make better decisions. In the later stages, AI increasingly becomes part of the decision-making process itself. The benefits are obvious: faster response times, greater consistency and reduced operational overhead. However, the closer organizations move towards autonomous operations, the more important governance, accountability and trust become.
From an operational perspective, this is an attractive proposition. From a resilience perspective, it changes the nature of the challenge entirely.
The first stage focuses on observation. Organizations use AI to analyze logs, metrics, traces and events, helping engineers understand what happened and where potential issues originate.
The second stage introduces prediction. Machine learning models identify patterns that indicate future capacity constraints, performance degradation or operational incidents before they are visible to end users.
The third stage is where the real shift occurs. AI no longer supports decision-making; it participates in decision-making. Autonomous agents can diagnose incidents, determine remediation actions and execute those actions within predefined boundaries. The role of engineers changes from executing operational tasks to defining policies, guardrails and escalation mechanisms.
The Resilience Paradox
Much of the AIOps market presents autonomous remediation as the logical next step in operational maturity. Technically, that is difficult to argue against. However, there is a paradox hidden within this evolution.
A system designed to improve resilience can also become a source of operational risk.
Traditionally, resilience focused on minimizing downtime, improving recovery times and ensuring continuity during failures. Autonomous operations introduce a fundamentally different challenge.
Historically, resilience focused on protecting systems from failure. Autonomous operations introduce a new requirement: protecting systems from the recovery mechanisms themselves.
The challenge is no longer whether systems can recover. The challenge is ensuring that recovery actions remain controlled, explainable and aligned with business intent.
An autonomous agent may restart services unnecessarily. It may trigger expensive scaling actions based on incomplete information. It may repeatedly mask symptoms without exposing an underlying architectural weakness. It may even execute a technically correct action that conflicts with business priorities or operational policies.
In other words, autonomous remediation does not eliminate operational risk; it changes where that risk resides.
Historically, resilience was about surviving failure. Increasingly, resilience is also becoming about trusting the systems responsible for recovery.=
This shifts the central question from: How quickly can we recover? -> How can we ensure autonomous recovery remains controlled, explainable and aligned with business intent? The challenge is no longer simply recovering faster.
Governance moves into runtime
One of the most common misconceptions I encounter is that governance is primarily a compliance activity. For autonomous operations, governance becomes something very different. It becomes an operational capability.
What organizations often underestimate is that autonomous operations move governance decisions from design-time into run-time. Decisions that were previously reviewed by architecture boards, operational teams or change advisory processes increasingly need to be enforced automatically through policies and controls.
Traditional governance focuses on decisions made before systems enter production. Architecture reviews, change approvals, security assessments and risk evaluations all occur before runtime.
Autonomous operations require governance during runtime. Organizations must define which actions an AI system may execute independently, which actions require human approval, and under which circumstances escalation becomes mandatory.
Questions that were previously addressed through operational processes must increasingly be encoded into policy-driven controls:
- Can an agent restart a service?
- Can it scale infrastructure?
- Can it change a configuration?
- Can it initiate a failover procedure?
These are no longer purely technical questions; they are governance decisions with operational consequences.
In many organizations, the technical discussion around autonomous operations progresses significantly faster than the governance discussion. The question is often whether autonomous remediation is technically feasible, while the more important question is whether the organization is prepared to govern and trust those actions once they occur.
As organizations increase operational autonomy, governance maturity must increase alongside it. Every increase in operational autonomy should be matched by an increase in governance maturity.
AI for Operations and Operations for AI
Another development is starting to emerge alongside AIOps. For years, organizations have focused on using AI to operate IT environments. Increasingly, they must also learn how to operate AI systems themselves.
Large language models, agents and AI platforms introduce operational concerns that did not previously exist. Model drift, prompt drift, token consumption, AI safety controls, external dependencies and cost management all become part of the operational landscape.
What I observe in practice is that many organizations are building governance, observability and resilience capabilities twice: once for traditional platforms and again for AI systems.
Over time, these capabilities will likely converge into a single operating model for digital systems. Organizations that recognize this early can avoid fragmented governance models, duplicate operational processes and inconsistent control mechanisms across their technology landscape.
The industry frequently talks about AI for Operations. What receives far less attention is the growing need for Operations for AI. Interestingly, both challenges require many of the same capabilities: observability, governance, policy management, auditability and resilience.
Organizations that continue to treat AI operations as a separate discussion may eventually discover that they are solving the same problems twice.
Resilience and Sovereignty
Another area that deserves more attention is the relationship between resilience and sovereignty. Organizations often treat sovereignty as a regulatory, legal or procurement concern. Increasingly, I see it as a resilience concern.
In several AI strategy discussions, I notice that sovereignty is primarily framed as a legal or regulatory topic. The operational implications often receive far less attention, despite their potential impact on long-term resilience.
Most organizations are consolidating observability, automation and operational tooling onto a smaller number of strategic platforms. The operational benefits are clear: greater consistency, lower complexity and improved visibility.
However, consolidation also creates dependency. Consider an operational platform that relies on external foundation models for diagnosis and remediation recommendations. While the operational process may appear internal, part of the decision-making capability can be owned, governed and operated by external providers. As operational decisions become increasingly influenced by AI-driven platforms, resilience becomes partially dependent on the availability, policies and strategic direction of those platforms.
If a critical operational capability depends on models, control planes or services that are outside the organization’s direct control, resilience becomes intertwined with sovereignty. The question is no longer only whether a platform can make the correct operational decision.
The question is whether an organization retains sufficient control over the models, policies, data and decision-making processes that influence those decisions. A highly autonomous operating model may improve efficiency while simultaneously increasing strategic dependency.
As organizations continue to adopt AI-driven operational platforms, architectural decisions about dependency, control and sovereignty become increasingly relevant to resilience itself. Architecture leaders must evaluate both dimensions together.
What Architecture Leaders Should Consider
Across client discussions, architecture reviews and transformation programs, I consistently encounter the same themes. First, technology maturity often advances faster than organizational maturity. Autonomous capabilities are frequently implemented before governance models fully adapt. Second, transparency becomes increasingly important as autonomy increases. Every autonomous action should be explainable, traceable and auditable. Third, resilience should no longer be viewed solely as an operational concern. It is increasingly an architecture concern, a governance concern and a strategic concern. Finally, organizations should not measure success by the amount of automation they deploy. They should measure success by the level of trust they can place in autonomous decisions.
The challenge is no longer whether AI can operate IT. The challenge is whether organizations are prepared to govern systems that can act on their behalf.
Conclusion
AIOps is evolving from observation to prediction and ultimately towards autonomous action. The technology is advancing rapidly, and the potential benefits are significant. Faster recovery, improved consistency and reduced operational burden are compelling outcomes for organizations managing increasingly complex digital environments.
However, the most important challenge is not the technology itself. The real challenge is ensuring that governance, resilience and accountability evolve at the same pace as autonomy.
As organizations move from observing systems to allowing systems to act, resilience becomes more than the ability to recover from failure. It becomes the ability to trust the systems performing that recovery on our behalf.
Organizations are investing heavily in preparing AI to operate IT. Far fewer are investing the same effort in preparing their IT organizations to govern systems that can act autonomously on their behalf.
Ultimately, the challenge is no longer whether AI can operate IT. The challenge is whether organizations are ready to trust, govern and remain accountable for the decisions made by autonomous systems. That may prove to be the defining challenge of autonomous operations.