Brazil Patch 2, Brazil Patch 1, Brazil, Australia Patch 8, Australia Patch 7, Australia Patch 6, Australia Patch 5, Australia Patch 4, Australia Patch 3, Australia Patch 1
Generative AI
ServiceNow AI Control Tower is a centralized enterprise governance and visibility workspace. It helps organizations discover, govern, secure, observe, and measure all AI assets—including internal models and third-party agents.
- AI Control Tower: A single-pane view of your organization's AI footprint with actionable insights for governance and control.
- Centralized AI asset inventory: Centralized view for your AI systems, AI models, prompts, MCP servers, and datasets, and how they relate to each other.
- Discover: Automatically discover AI across the enterprise, including hyperscalers, SaaS platforms, and dev platforms. Also, automatically discover Now Otto skills and ServiceNow deployed models.
- Govern: Establish AI strategy, manage risk and lifecycle, deploy and enforce integrated controls, and demonstrate compliance. Connect AI investments to business outcomes, and automate compliance with the EU AI Act and NIST AI RMF through continuous governance rather than periodic audits.
- Secure: Track AI agent access, security posture metrics, and guardrails. Take action through automated workflows while maintaining control across your entire AI landscape. Analyze exposure, prompt injections, and offensive content.
- Observe: Continuously monitor and evaluate AI agents' performance through metrics and log traces. Quality and safety scoring feeds value calculations.
- Measure: Quantify AI's business impact with comprehensive metrics that track adoption rates, realized value, and ROI.
- AI Native platform experience: Built-in AI insights and recommendations that drive action, not just reporting.
Inventory and Discovery
New
- Shadow AI: Details on detected AI services, guidance for unknown users and devices, end-user input, an option to hide the UI, and a department block.
- Connectors: Trace Collector discovers Tools. Hyperscaler connectors install automatically. Anthropic discovers Agents via Beta APIs and supports MID servers. GCP imports Gemini Enterprise App Agents with clearer errors. Microsoft adds attributes and tag-based discovery. Databricks adds Domain Separation. GitHub discovers organizations, repositories, and Copilot agents, with scheduled imports and Cloud and Enterprise support.
Changed
- Shadow AI lifetime aggregations limited to 3 years.
- GCP Beta API usage UX updated.
Fixed
- Shadow AI UI performance and registry filtering.
- AI Discovery Agentic Client support and staging domain fallback.
- Anthropic false success on Test Connection; LangGraph duplicates and standalone run usage; several GCP issues.
Govern
New
- AI & Data Marketplace: Business users choose from approved use cases and models.
- AI Policy Framework v1.2: MVP release with kill switch.
Fixed
- Playbook and lifecycle fixes in AI Risk and Compliance, and AI Risk and Asset Management.
- Rejection comments display; rejected requests set to "Cancelled."
Secure
New
- AI Security Operator role: Deactivate and reinstate agents without full AI Steward access.
- AWH for AI Control Tower: Client-Based Access Control (CBAC).
Changed
- Top recommendations ranks agents by critical security events.
- Action required on upgrade: Base Traceloop Warehouse connection removed. Recreate it and its credential if you use Traceloop-based metrics. Sampling and max-skill-call defaults reset.
- Security tab split into Overview, Runtime, Post-runtime, and Security insights.
- Renames: "Correctness detection" and "Agent containment list."
- Consent required for Post-runtime and Security insights settings.
Fixed
- Four customer-reported bugs, including silent AWS Bedrock block/unblock failures.
- Multiple fixes across anonymization, heatmaps, agent maps, Overview load time, and CBAC policy names.
Monitor
New
- Direct trace access for usage mismatches.
- Severity-based grouping of score drops.
- Agent activity chart filters by top or bottom five metrics.
- Metric scores and LLM judge reasoning on session details.
- Input and output toggle in trace details.
Changed
- Arc traces evaluated at asset level for Agentic Client assets; Tools discovery and evaluation added.
- Reduced insight noise; widget customization across AICT pages.
Fixed
- Redundant session scores removed; Privileged Access Detector shows 0% in red.
- Custom date selection and duplicate insights.
Measure
Fixed
- Functional and non-functional IT defects.
- Creator metrics for managed and unmanaged AI systems.
Foundations
Changed
- AINPX UI: AI Gateway access management, runtime security configuration, a Security Insights tab, connector upgrades, and LLM-based deduplication.
Fixed
- EA for AICT domain separation on AI Portfolio widgets.
- AWH: correct Tool Groups count, MCP sync job errors, and catalog population on new instances.
- Otto: manufacturer, vendor, and owned_by details resolve correctly.
Full details: https://www.servicenow.com/docs/r/release-notes/ai-control-tower-rn.html
Not applicable for this application version. For more information, please see
Application Runtime Policy
Requires platform version Brazil Patch 2 or Australia Patch 8