ServiceNow AI Vendor Risk Profile
Enterprise workflow automation platform integrating AI through Now Assist, which combines ServiceNow's proprietary Now LLM models with OpenAI and other third-party models for IT service management, HR, and customer service workflows.
Risk overview
Risk score: 24/100
Risk tier: Moderate
Safety rating: 76/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 42/100 |
| IP Exposure | 15/100 |
| Jurisdiction | 13/100 |
| Security | 18/100 |
| Regulatory Compliance | 10/100 |
| Transparency | 55/100 |
| Business Stability | 10/100 |
| Dependency Chain | 23/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Recommended
ServiceNow's Now Assist and the Generative AI Controller integrate AI into the dominant enterprise ITSM and workflow platform, with no training on customer instance data and FedRAMP High authorization for Government Community Cloud. Now LLM plus Azure OpenAI routing options give customers deployment flexibility inside an already-mature compliance perimeter.
Bottom line: Clean extension of ServiceNow's already-strong compliance posture; a recommended choice for ServiceNow customers.
Strengths
- No training on customer instance data
- Full compliance stack: SOC 2 Type II, ISO 27001/27017/27018/27701, FedRAMP High (GCC), HIPAA BAA
- Generative AI Controller allows customer-controlled Azure OpenAI routing with zero retention
- Customer retains full ownership of all Customer Data and Now Assist outputs
- AI features embedded in existing ITSM, HR, CSM, and ITAM workflows
Concerns
- Now Assist pricing is per-fulfiller and can escalate sharply at enterprise scale
- Deep Now Assist value is unlocked only for existing ServiceNow customers
- Some AI features depend on upstream Azure OpenAI for full capability
Best for
- ServiceNow-standardized enterprises adding AI to ITSM, HR, and workflow automation
- Federal civilian agencies requiring FedRAMP High AI inside existing ServiceNow tenants
- Healthcare and financial services needing HIPAA and regulated-industry AI on ServiceNow
Avoid if
- You are not already on ServiceNow (the AI alone is not a reason to adopt)
- You need general-purpose AI outside of ITSM and workflow use cases
- Your budget cannot absorb per-fulfiller Now Assist pricing
Citations
- Data Handling — Hipaa Baa Available
ServiceNow offers HIPAA Business Associate Agreements for customers on the ServiceNow Government Community Cloud and Healthcare offerings.
- Data Handling — Third Party Data Sharing
Now Assist can optionally route to Azure OpenAI with customer-controlled keys and zero-retention agreements in place.
- Data Handling — Trains On User Data
ServiceNow Now Assist does not use customer instance data to train the Now LLM or any third-party foundation models.
- Ip Profiles — User Owns Outputs
Customer retains all right, title, and interest in Customer Data, including Now Assist generated outputs derived from Customer Data.
- Jurisdiction Profiles — Incorporation Country
ServiceNow, Inc. is a Delaware corporation headquartered in Santa Clara, California (SEC Form 10-K).
- Security Compliance — Fedramp Authorized
ServiceNow Government Community Cloud holds FedRAMP High authorization; commercial cloud holds FedRAMP Moderate.
- Security Compliance — Iso 27001
ServiceNow holds ISO/IEC 27001, 27017, 27018, and 27701 certifications.
- Security Compliance — Soc2 Type2
ServiceNow maintains SOC 2 Type II attestation with reports available via the Trust portal.