ServiceNow AI Control Tower: governance workflow, not runtime control

What changed

ServiceNow announced that its AI Control Tower can discover and govern any AI agent across models and clouds, track costs, and stop behavior that violates policy. The platform aims to provide enterprise-wide visibility to monitor and manage every AI agent, model, and workflow in one place. More than 500 customers went live with AI Control Tower in the first six months, and ServiceNow reported AI annual contract value above 1 billion dollars in Q2, with a full-year target of 1.5 billion dollars.

ServiceNow’s competitive advantage rests on its existing installed base. The company operates configuration management databases, IT service management, change management workflows, and security operations integrations that give it distribution and data advantages most governance vendors lack. The platform supports roughly 100 billion workflows and nearly 8 trillion transactions.

However, field research based on in-depth interviews with 15 large-enterprise ServiceNow customers conducted from September 15 to 21, 2026, reveals a more complicated picture than marketing claims suggest. The study separated direct customer experience from vendor statements and found that ServiceNow’s strengths and limitations cluster around three distinct technical functions: governance workflow and accountability, AI lifecycle evidence, and runtime enforcement.

Why it matters

ServiceNow AI Control Tower addresses a real governance gap. As autonomous agents proliferate across business workflows, enterprises need visibility into which agents run, who owns them, what models they use, and whether they comply with policy. ServiceNow handles the workflow layer well: inventory, accountability, approvals, exceptions, remediation, and audit trails. Most enterprises lack this operational context entirely.

But there is a gap between what ServiceNow sells and what it delivers end-to-end. Field research shows that fourteen of the fifteen customers surveyed described runtime enforcement, actually intercepting an action, blocking a deployment, constraining an agent, or revoking access in real time, as external, custom, human-mediated, or not proven at enterprise scale. Only one financial-services customer successfully tested ServiceNow’s blocking capability for a single model and agent in a limited pilot. Twelve of fifteen identified a model-specific evidence gap: they lack validation records, lineage documentation, bias reports, explainability data, drift history, or AI-specific regulatory artifacts generated within ServiceNow.

Twelve of fifteen customers tied their governance value and switching cost to the wider Now Platform, not AI Control Tower alone. That means the business case depends on existing CMDB maturity, ITSM integration, and change management workflows. When those foundational elements are weak, Control Tower’s value degrades.

The research also shows that ServiceNow’s architecture creates both its competitive moat and its boundary limits. The same operational integration that makes ServiceNow hard to displace also constrains what it can do. When the CMDB is immature, when the AI estate sits outside ServiceNow control paths, or when regulators require technical evidence generated elsewhere, the governance story becomes more complicated. One customer described ServiceNow as “more like a governance orchestration layer than the actual governance of AI.”

ServiceNow’s right-to-win argument is not that it builds the best foundation models or the most sophisticated AI controls. It is that ServiceNow already knows how work moves through the enterprise. The CMDB identifies assets, services, owners, and dependencies. ITSM and change management know how work is routed and approved. A best-of-breed specialist may have deeper model analytics, but it often lacks the operational graph that identifies the owner, business service, or the path to remediate an issue.

What to test

Before adopting ServiceNow AI Control Tower, evaluate these claims:

Governance workflow vs. technical control

Verify whether you need workflow orchestration (approvals, routing, ticketing, audit trails) or technical runtime enforcement. ServiceNow is demonstrably strong at the first. The second remains largely unvalidated at enterprise scale in most deployments. Test whether your use case actually requires blocking or revoking an agent in real time, or whether post-action remediation through workflow is acceptable.

CMDB readiness

ServiceNow’s advantage depends on a clean, consolidated CMDB. If yours is fragmented across business units or contains stale data, runtime discovery may miss agents or misattribute ownership. Conduct a CMDB audit before implementation. One financial-services customer noted that CMDB cleanup requires ongoing surveys and audits to remain useful. Budget for that operational work. ServiceNow management has historically pushed customers toward consolidating on a single CMDB, which today is the norm but still requires regular maintenance.

Model evidence and compliance

Ask the vendor specifically what model-specific evidence Control Tower generates vs. coordinates. The field study found that twelve of fifteen customers had to source validation records, bias reports, lineage, and drift data from systems outside ServiceNow. If your regulatory requirements demand this evidence, understand which tools generate it and how Control Tower ingests and displays it.

Runtime enforcement scope

Ask for reference customers who have successfully deployed runtime blocking or agent constraint enforcement at scale. The field study found only one limited pilot in financial services that validated this capability. If runtime enforcement is critical to your governance posture, test it in a pilot on a single model and agent before rolling out broadly.

Switching cost and platform lock-in

Understand how much of your Control Tower value depends on ITSM, change management, and SecOps integration. Test whether you could move governance to a best-of-breed alternative if needed. The field study showed that customers were more likely to stick with ServiceNow because of operational incumbency than because of AI-specific features alone.

Common questions

What does ServiceNow AI Control Tower do?

AI Control Tower discovers and governs any AI agent across models and clouds. It can inventory AI assets, connect risks to owners, route approvals and remediation, and preserve audit trails. Field research shows this governance workflow layer is strong, but runtime enforcement, blocking deployments or revoking access in real time, remains external or custom in most deployments.

What is an AI agent control tower?

An AI agent control tower is a centralized governance and oversight platform designed to provide transparency, control, and assurance over AI agents deployed across an enterprise. ServiceNow’s version emphasizes workflow orchestration around discovery, ownership, approvals, and remediation, though full technical enforcement varies by implementation.

Can ServiceNow AI Control Tower enforce policy in real time?

Field research found that fourteen of fifteen enterprise customers described runtime enforcement as external, custom, human-mediated, or not proven at scale. One financial-services customer successfully tested ServiceNow’s blocking capability for a single model and agent in a pilot. This remains a limitation rather than a broadly validated capability.

The conclusion

ServiceNow AI Control Tower represents a significant bet on enterprise AI governance, but it delivers most value as a governance workflow and accountability layer, not as a complete technical enforcement plane. The platform’s strength lies in its operational moat: CMDB, ITSM, change management, and security operations integrations give it distribution and context most governance vendors lack. That advantage is real and defensible for workflow-centric governance.

However, buyers should be cautious of claims that Control Tower is universally end-to-end. Runtime enforcement remains largely external or custom. Model-specific evidence often comes from other systems. And value degrades when CMDB is immature or the AI estate sits outside ServiceNow control paths.

The vendor’s right-to-win argument is not that ServiceNow builds the best AI governance controls. It is that ServiceNow already knows how work moves through the enterprise and can embed governance as an operational responsibility rather than a separate function. That is a legitimate advantage. But it also defines the boundaries of what the platform does well today.

Watch whether ServiceNow extends technical runtime enforcement or whether governance orchestration remains its primary value driver. Pay attention to how customers with external AI estates, built on tools like Perplexity SPACE or other platforms outside Now Platform, integrate Control Tower. And monitor whether regulators begin to mandate model-specific evidence that Control Tower cannot generate natively, forcing customers to build custom bridges to other systems.

For now, Control Tower is selling a penthouse while still building the frame.

Related reading

• Voxel51 3.0 adds multimodal data platform with AI agents
• Perplexity SPACE: Sandbox platform for AI agents
• LFM2.5-24B-A2B: Fast on-device reasoning agents